Senior Cyber Risk Controller (Global, 2nd Line)

UBS; New York (NY); On-site; USD 200,000 - 275,000; Full time

Job summary

UBS is seeking a senior professional to protect the firm from cyber and technology risk. You will collaborate with GCORC to address remediation, formulate cyber risk opinions, and provide challenge to first line of defense on control design and effectiveness.

Ideal candidates have 10+ years in cyber risk, experience with regulatory expectations, and strong communication skills to translate risk into actionable guidance for business partners and boards.

Qualifications

• 10+ years of Cyber/Security experience in financial services.
• Experience communicating with auditors, regulators, and tech SMEs.
• Ability to translate risk assessments into actionable feedback.
• Experience with cross-functional teams and risk remediation.
• Understanding of NIST/CRI frameworks and SOX controls.
• Experience evaluating Cyber Risk testing results and driving remediation.

Responsibilities

• Collaborate with GCORC to address cyber risk remediation and strategy.
• Formulate cyber risk opinions on emerging risks and third-party risk.
• Challenge and assure design and operation of cyber controls across UBS.
• Ensure information security risks are understood, owned, and managed.
• Review projects and initiatives for risk, incidents and controls.
• Perform data analysis, deep dives, controls testing, and risk assessments.

Skills

Cyber risk management

Regulatory knowledge

NIST/CRI frameworks

SOX controls experience

Data analysis

Stakeholder management

Audit coordination

AI in workflows

Written and verbal communication

Education

CISSP certification

CISA certification

CEH certification

Tools

ITIL processes

Secure SDLC

Job description

UBS is seeking a senior professional to protect the firm from cyber and technology risk. You will collaborate with GCORC to address remediation, formulate cyber risk opinions, and provide challenge to first line of defense on control design and effectiveness.

Ideal candidates have 10+ years in cyber risk, experience with regulatory expectations, and strong communication skills to translate risk into actionable guidance for business partners and boards.