Senior Cybersecurity Governance & Risk Lead

OneMain Financial; Maryland; On-site; USD 150,000 - 185,000; Full time

Job summary

OneMain Financial is seeking a Manager of Cybersecurity Governance to lead a comprehensive governance framework for on‑premise and cloud environments, ensuring regulatory compliance and risk visibility across the technology stack.

You will partner with risk, internal audit, and technology teams to drive policy, controls, and assurance activities, and establish a data‑driven GRC program delivering management insights to reduce risk.

Qualifications

• Bachelor's degree in Cybersecurity, IT, or equivalent.
• 5–7 years in governance and controls in finance or regulated industry.
• 3–5 years in a leadership role.
• Deep knowledge of NIST, SOC2, and CIS.
• Familiarity with GLBA 501(b), NYDFS, PCI.
• Strong communication and program management skills.

Responsibilities

• Establish and maintain a security governance framework based on NIST CSF.
• Oversee policy program, drafting policies, controls, and enforcement.
• Maintain risk and controls matrix aligned with SOC2, CIS, PCI, NIST.
• Lead annual enterprise technology and cybersecurity risk assessment.
• Establish an automated GRC program to monitor risk and control effectiveness.
• Lead annual NYDFS Part 500 Cybersecurity self-assessment.
• Oversee SOC2 audits and regulatory exams.
• Educate and direct projects to apply policies across tech, systems and services.
• Coordinate with risk management, internal audit, and cyber risk teams.
• Partner with architects, engineers, and operations to implement governance controls.
• Lead metrics and reporting program for senior management.

Skills

Governance leadership

Regulatory compliance

Cybersecurity frameworks

Policy development

Communication & collaboration

Education

Bachelor's degree in Cybersecurity/IT

Tools

Archer

Power BI

Anecdotes

Job description

OneMain Financial is seeking a Manager of Cybersecurity Governance to lead a comprehensive governance framework for on‑premise and cloud environments, ensuring regulatory compliance and risk visibility across the technology stack.

You will partner with risk, internal audit, and technology teams to drive policy, controls, and assurance activities, and establish a data‑driven GRC program delivering management insights to reduce risk.