Cybersecurity Risk Governance Principal

HITEC; Columbus (IN); Remote; USD 131,000 - 161,000; Full time

Job summary

HITEC is seeking a Cybersecurity Risk Governance Principal to lead enterprise risk governance and drive strategic risk treatment across the organization. This remote role collaborates with governance, BRI, cyber threat intelligence, and business stakeholders to prioritize cyber risks and align with business objectives.

The role requires 5–7 years of cybersecurity experience with 3–5 years in risk management, strong knowledge of NIST RMF and FAIR, and certifications such as CISSP or CISM are

Qualifications

• Bachelor’s degree in cybersecurity, information technology, or related field.
• 5–7 years of cybersecurity experience with 3–5 years in risk management or enterprise risk management.
• Experience with risk governance processes, risk reporting, and treatment prioritization.
• Familiarity with risk frameworks and regulatory requirements; strong communication and collaboration skills.

Responsibilities

• Lead enterprise cyber risk governance, identifying, assessing and reporting risks.
• Coordinate cross-functional risk treatment with cybersecurity, legal, privacy, compliance and business units.
• Present risk posture to senior leadership and support ERM committees.
• Define governance for risk acceptance and exceptions; oversee funding paths and timelines.
• Mentor and develop teams; recruit and manage global teams to deliver value.

Skills

Risk governance leadership

Cross-functional risk orchestration

Business insight

Strategic planning

Executive communication

Education

Bachelor’s degree in cybersecurity / information technology

Tools

NIST RMF

FAIR

CISSP / CISM (preferred)

Job description

We are looking for a talented Cybersecurity Risk Governance Principal to join our team specializing in Systems/Information Technology for our Corporate organization. This is a remote role.

In this role, you will make an impact in the following ways:

• Lead the identification, assessment, and mitigation of cybersecurity risks by applying Cummins cybersecurity policies, risk management frameworks, and data privacy principles to protect critical business assets.
• Develop and execute cybersecurity strategies that proactively address emerging threats, reduce organizational risk, and strengthen the overall security posture of the business.
• Drive the application of industry frameworks and standards, including NIST, ISO, ITIL, and COBIT, ensuring cybersecurity controls and processes align with organizational objectives and compliance requirements.
• Serve as a trusted advisor to business and technology stakeholders, providing guidance on new and evolving technology solutions while balancing innovation with security and risk management.
• Influence and advocate for cybersecurity policy enhancements that improve governance, support evolving business needs, and reinforce enterprise-wide security practices.
• Lead financial planning activities, including Annual Operating Plan (AOP) development, budget management, forecasting, and resource allocation to ensure effective investment in cybersecurity initiatives.
• Build, develop, and lead high-performing teams through strategic recruiting, performance management, coaching, succession planning, and global team collaboration.
• Foster strong cross-functional relationships and a culture of accountability, ensuring adherence to Cyber, IT, and Corporate policies while delivering measurable business value through effective Business Relationship Management practices.

To be successful in this role you will need the following:

Balances stakeholders - Anticipating and balancing the needs of multiple stakeholders.

Business insight - Applying knowledge of business and the marketplace to advance the organization’s goals.

Demonstrates self-awareness - Using a combination of feedback and reflection to gain productive insight into personal strengths and weaknesses.

Develops talent - Developing people to meet both their career goals and the organization’s goals.

Global perspective - Taking a broad view when approaching issues, using a global lens.

Manages complexity - Making sense of complex, high quantity, and sometimes contradictory information to effectively solve problems.

Persuades - Using compelling arguments to gain the support and commitment of others.

Plans and aligns - Planning and prioritizing work to meet commitments aligned with organizational goals.

Resourcefulness - Securing and deploying resources effectively and efficiently.

Strategic mindset - Seeing ahead to future possibilities and translating them into breakthrough strategies.

Facilitation - Guides group discussions or training by creating an active environment where questions are posed, perspectives are shared, and debates occur with the goal of gaining understanding, analyzing issues, resolving conflict, exploring solutions, or making decisions.

Cybersecurity Risk Management - Identifies and assesses the potential impact of Cybersecurity risks against established Cybersecurity industry frameworks, regulations and organizational policies to develop and implement risk mitigation strategies in alignment with business objectives.

Values differences - Recognizing the value that different perspectives and cultures bring to an organization.

Education, Licenses, Certifications:

College, university, or equivalent degree in Cybersecurity, Computer Science, or Information Technology, or related subject, or relevant equivalent experience required. This position may require licensing for compliance with export controls or sanctions regulations.

Experience:

Significant level of relevant work experience required. 5-7 years of experience

This role leads enterprise cybersecurity risk governance, connecting security functions and business stakeholders to prioritize and reduce strategic cyber risks in line with business objectives and risk appetite.

• Risk governance leadership: The manager administers the enterprise cyber risk governance process, ensures consistent risk identification and reporting, guides risk acceptance, and recommends treatment strategies and investment priorities based on risk reduction value and business impact.
• Cross-functional risk orchestration: The role integrates threat intelligence and emerging threat trends into treatment priorities, coordinates stakeholders across cybersecurity, legal, privacy, compliance, and business units, resolves roadblocks, and ensures treatment plans have owners, funding paths, and timelines. It also presents risk posture and business impacts to senior leadership and supports enterprise risk management committees.
• Qualifications and environment: Candidates need a bachelor’s degree in cybersecurity, information technology, or a related field; 5 to 7 years of cybersecurity experience, including 3 to 5 years in cybersecurity risk management or enterprise risk management; familiarity with NIST RMF, FAIR, or quantitative risk methods; and knowledge of threat intelligence, security operations, identity and access management, cloud security, privacy, legal risk, and regulatory requirements. Strong communication, analytical, organizational, and collaboration skills are required, while CISSP, CISM, or equivalent certification is preferred.

The Cybersecurity Risk Governance Manager will serve as the central orchestrator between Governance, BRI, Cyber Threat Intelligence, Cyber Operations, and Business stakeholders to ensure enterprise strategic cyber risks are understood, prioritized, and reduced through coordinated treatment strategies aligned with business objectives and risk appetite.

1. Enterprise Risk Governance:
2. Leads the operation and administration of the enterprise cyber risk governance process under the direction of Cybersecurity Governance leadership.
3. Ensure risks are consistently identified, assessed, categorized, and reported.
4. Facilitate risk acceptance governance and provide recommendations to decision-makers.
5. Strategic Risk Treatment Leadership:
6. Recommend enterprise-wide treatment strategies targeting root causes rather than individual issues.
7. Recommend risk reduction investment priorities based on risk reduction value and business impact.
8. Threat and Intelligence Integration:
9. Partner closely with BRI and Cyber Threat Intelligence to address emerging threats.
10. Translate threat trends, intelligence reports, and emerging risk drivers into strategic risk treatment priorities.
11. Assess how evolving threat activity impacts enterprise risk exposure.
12. Cross-Functional Orchestration:
13. Convene stakeholders from Cyber Ops, IAM, Infrastructure, Application Security, Compliance, Privacy, Legal, and Business Units.
14. Resolve roadblocks impacting risk reduction initiatives.
15. Ensure strategic treatment plans have accountable owners, funding paths, and timelines.
16. Executive Risk Communication & Reporting:
17. Present risk posture and treatment progress to senior leadership.
18. Translate technical cyber risks into business impacts (Financial, Operational, Regulatory, Reputational)
19. Support ERM & governance committees as Cybersecurity Risk Expert.
20. Risk Exception & Acceptance Governance:
21. Define and govern risk acceptance criteria, approval authorities, oversight requirements and exception management processes.
22. Establish and oversee the governance framework for risk acceptance and exceptions.

Min Salary $131400

Max Salary $160600

100% On-Site No

As Cummins continues to grow, you'll be provided with continuous learning opportunities, supportive benefits and a culture that values your wellbeing, safety and work-life balance. Here, you'll have the power to determine your future with innovative technology, a focus on sustainability and with a company positioned for long-term growth.