Information Security Governance & Risk Officer

Bank Newport; Middletown (RI); On-site; USD 140,000 - 190,000; Full time

Job summary

BankNewport in Middletown, RI seeks an Information Security Governance & Risk Officer to lead the bank's governance, risk, compliance, resiliency, and assurance programs. Reporting to the CISO, the role translates regulatory requirements into practical oversight, drives risk assessments, policy governance, audits, business continuity, and executive reporting.

You will oversee vendor and technology risk, third-party due diligence, and control effectiveness, while coordinating with Legal,

Qualifications

• Advanced knowledge of information security governance, enterprise risk, third-party risk, control assurance, policy governance, and regulatory exam practices.
• Knowledge of financial services laws and guidance (GLBA, FFIEC, etc.).
• Familiarity with NIST Cybersecurity Framework and related risk management frameworks.
• Ability to evaluate SOC reports, assessments, and remediation evidence.
• Strong leadership, writing, presentation, and stakeholder-management skills.
• Experience coordinating multiple GRC disciplines and reporting to executives.

Responsibilities

• Oversee governance, risk, and control across assigned information security programs.
• Translate laws, guidance, and policy into program requirements, metrics, and escalation criteria.
• Lead information security due diligence and ongoing third-party oversight, including vendor risk assessments.
• Maintain an integrated register of risks, findings, exceptions, owners, and remediation status.
• Define and monitor audit, examination, and control testing activities with clear ownership.
• Coordinate policy lifecycle, standards, and governance documents with stakeholders.
• Oversee Business Continuity, Disaster Recovery, and operational resilience programs.
• Lead Security Awareness, phishing testing, and culture-building initiatives.
• Support AI governance and emerging-technology risk management.

Skills

Information Security Governance

Technology Risk

Third-Party Risk

Audit & Compliance

Policy Governance

Regulatory Guidance

Leadership

Communication

Education

Bachelor's degree in information security

Job description

Overview

BankNewport celebrates being a community bank since 1819. Offering new and exciting career opportunities, BankNewport is committed to providing our employees the resource and guidance to develop careers that are challenging and rewarding.

So if you're looking for a great professional opportunity, know that BankNewport will empower and invest in you.

The Information Security Governance & Risk Officer leads the Bank's information security governance, risk, compliance, resiliency, awareness, and assurance programs. Reporting to the Chief Information Security Officer and working alongside the Information Security Operations Officer, the role provides independent oversight of vendor and technology risk, risk assessments, policy governance, audits and examinations, issue remediation, business continuity and disaster recovery, security awareness and phishing testing, governance metrics, and related regulatory obligations.

The role translates regulatory, policy, and risk requirements into practical oversight, remediation, and reporting. The CISO retains accountability for the Information Security Program, strategy, risk acceptance, major incident command, and executive and Board reporting. Technology, business, vendor, and system owners remain accountable for implementing and operating controls.

Responsibilities

Governance, Risk, and Control Oversight

• Establish consistent governance methods, schedules, documentation, metrics, evidence standards, and issue-management practices across assigned programs.
• Work with the Legal and Compliance teams to translate applicable laws, guidance, Bank policies, risk appetite, and security standards into program requirements, control expectations, reporting, and escalation criteria.
• Provide independent oversight by assessing risks and controls, confirming ownership and timely remediation, validating outcomes, and escalating residual risk. Information Security defines requirements and provides oversight; Technology, business, vendor, and system owners implement and operate controls.

Technology and Third-Party Risk Management

• Lead risk methodologies, inventories, scoring, assessment schedules, and reporting for information security, technology, customer information, third parties, cloud services, projects, business changes, and emerging risks.
• Coordinate stakeholder assessments of threats, vulnerabilities, control effectiveness, business impact, data sensitivity, criticality, dependencies, third-party exposure, compensating controls, and residual risk; recommend treatment.
• Lead Information Security due diligence and ongoing third-party oversight, including onboarding, risk tiering, periodic and material-change reviews, contractual and resiliency requirements, issue follow-up, and offboarding.
• Maintain an integrated register of risks, findings, exceptions, compensating controls, owners, due dates, evidence, and status; coordinate remediation and elevate material, repeat, accepted, or overdue exposure.
• Validate closure through evidence or testing, identify themes and priorities, and maintain audit-ready risk records and recommendations for management, committees, examinations, and independent review.

Audit, Examination, Compliance, and Control Assurance

• Define Information Security scope, priorities, and engagement for audits, regulatory examinations, independent assessments, and control testing assigned by the CISO.
• Coordinate requests, interviews, evidence, responses, action plans, status tracking, and closure; maintain audit-ready records of ownership, approvals, exceptions, testing, remediation, and reporting.
• Map regulatory and framework requirements to policies, risks, controls, owners, evidence, and testing; identify gaps and recommend improvements.
• Monitor relevant laws, guidance, examination expectations, and industry practices and assess their impact on the Information Security Program.

Policy, Standards, and Governance Lifecycle

• Coordinate the lifecycle of assigned information security policies, standards, methodologies, procedures, and governance documents, including drafting, review, approval, publication, acknowledgment, exceptions, and periodic review. The CISO remains the designated policy owner where applicable.
• Keep governance documents aligned with the Bank's risk profile, operating model, regulatory obligations, supporting procedures, and control practices, with clear ownership, review dates, approvals, revision history, mappings, and exception records.
• Partner with the CISO, Legal, Compliance, Enterprise Risk Management, Technology, Human Resources, and business stakeholders to resolve interpretation and implementation questions.

Business Continuity, Disaster Recovery, and Operational Resilience

• Lead Information Security oversight of the Business Continuity Program and operational resilience, including business impact analyses, plan governance, dependencies, testing, exercises, issues, and reporting.
• Coordinate with business owners, Technology, Facilities, vendors, Crisis Management, and other stakeholders to maintain recovery requirements, plans, objectives, contacts, dependencies, and testing evidence.
• Assess disaster recovery test scope, results, exceptions, lessons learned, and remediation; report material risks and recommendations without assuming responsibility for Technology implementation or business-owned recovery procedures.

Security Awareness, Phishing Testing, and Culture

• Own the Bank's information security awareness and training program, including annual and role-based training, targeted education, policy communications, campaigns, and employee guidance.
• Lead phishing and social-engineering testing, including scenarios, execution, analysis, follow-up education, exceptions, metrics, improvement actions, and escalation.
• Use risk trends, incidents, audit findings, employee feedback, threat intelligence, and business changes to refine priorities.

AI and Emerging-Technology Governance

• Support the CISO's governance of artificial intelligence, automation, cloud services, and emerging capabilities through inventories, intake, risk tiering, assessments, approvals, exceptions, KRIs, documentation, and lifecycle review.
• Coordinate cross-functional assessment of security, privacy, regulatory, third-party, resiliency, human-oversight, and operational risks; monitor compliance and maintain review evidence.
• Escalate high-risk use cases, control gaps, exceptions, and residual-risk decisions requiring CISO or executive authority.

Incident Response Governance and Support

• Maintain incident response governance, including plans, roles, escalation criteria, regulatory and contractual requirements, exercises, lessons learned, and corrective actions.
• Support the CISO and Security Operations during incidents by coordinating governance activities, maintaining decision and evidence records, tracking notifications and commitments, and assisting with management, regulatory, audit, and committee reporting.
• Provide governance and risk support without assuming the CISO's incident-command authority or Security Operations' technical-response responsibilities.

Leadership, People Management, Reporting, and Business Partnership

• Set priorities, coordinate dependencies, remove delivery obstacles, and drive consistent execution and improvement across governance and risk initiatives.
• Supervise, coach, prioritize work, review quality, manage performance, and develop assigned Information Security staff, including building the Information Security Analyst's GRC and backup capabilities.
• Prepare concise dashboards, KRIs, risk statements, committee materials, status updates, and recommendations for the CISO, management, auditors, examiners, and governance bodies.
• Build effective relationships across Technology, Risk Management, Compliance, Legal, Procurement, Human Resources, Internal Audit, Finance, business units, vendors, and service providers.
• Represent Information Security in delegated meetings, projects, committees, audits, and examinations; provide defined coverage during the CISO’s absence and elevate matters requiring CISO or executive authority.
• Support strategy, budgets, staffing, roadmaps, succession planning, metrics, and measurable triggers for future capability or investment needs.

KNOWLEDGE, SKILLS, AND ABILITIES

• Advanced knowledge of information security governance, enterprise and technology risk, third-party risk, control assurance, issue management, policy governance, audit and examination practices, and operational resilience.
• Knowledge of financial-services laws and guidance, including GLBA, the Interagency Guidelines Establishing Information Security Standards, FFIEC guidance, applicable privacy requirements, and Bank policies.
• Knowledge of the NIST Cybersecurity Framework, NIST AI Risk Management Framework, NICE Framework concepts, and other relevant control and risk frameworks.
• Ability to evaluate SOC reports, assessments, vendor and contractual evidence, controls, resiliency materials, audit findings, and remediation evidence.
• Ability to design sustainable governance processes, set measurable requirements, analyze risk trends, distinguish oversight from implementation, and translate complex requirements into practical action.
• Ability to document defensible conclusions, communicate material issues, influence stakeholders, and maintain accountability for deliverables and remediation.
• Strong leadership, staff development, writing, presentation, analytical, organizational, project-management, judgment, discretion, relationship-management, and learning agility.

Qualifications

• Bachelor's degree in information security, cybersecurity, risk management, audit, information technology, business, or a related discipline, or equivalent training, certification, and experience.
• Five or more years of progressively responsible experience in information security governance, technology or third-party risk, audit, compliance, business continuity, or a related field.
• Demonstrated experience leading multiple GRC disciplines and producing management or committee reporting, maintaining audit-ready documentation, coordinating remediation, and communicating with senior leaders, auditors, or examiners.
• Experience in financial services or another regulated environment preferred.
• Relevant certifications such as CISA, CISM, CRISC, CISSP, CBCP, or equivalent preferred.
• Prior people-management, team-lead, program-lead, or staff-development experience preferred.

INDEPENDENT ACTION

Works independently within approved policies, standards, risk tolerances, methodologies, and program requirements. Exercises sound judgment in leading assigned governance and risk programs, setting work plans, coordinating stakeholders, challenging unsupported conclusions, and escalating material risks, exceptions, policy deviations, overdue remediation, examination concerns, and decisions requiring risk acceptance or executive authority.

SUPERVISORY SCOPE

Directly supervises assigned Information Security staff, initially the Information Security Analyst, including work prioritization, coaching, quality review, development, performance management, cross-training, continuity planning, and accountability. Provides functional leadership across governance and risk activities but has no authority over Technology or business personnel and does not perform Technology administration.

PHYSICAL REQUIREMENTS

• Travel