SVP & Director of IT Governance - Cyber Security

WesBanco, Inc.; Bowie (MD); Hybrid; USD 150,000 - 160,000; Full time

Benefits offered by this job

27 days PTO

11 annual holidays

401(k) with employer match

Job summary

WesBanco is seeking an SVP & Director of IT Governance - Cyber Security to lead the Bank's technology governance, risk management, and compliance program. The role requires executive presence to communicate risk to technical and non‑technical audiences, including Board committees.

The position manages IT GRC, policy hierarchy, vendor risk, AI governance, and regulatory examinations, with a focus on robust controls, risk metrics, and governance structures.

Qualifications

• Bachelor’s degree and/or equal education or experience required.
• Minimum of 10 years of progressive experience in IT risk, GRC, cybersecurity, or technology audit.
• Minimum of 3 years in a leadership or program management role.
• Minimum of 5 years of experience in a regulated financial institution (bank, credit union, or bank holding company).

Responsibilities

• Owns and matures the enterprise IT GRC program and control framework aligned to NIST CSF 2.0, CIS Controls, and FFIEC guidance.
• Manages technology audit and exam findings remediation with clear ownership and timelines.
• Leads the technology governance council structure and reports on progress to executive leadership and boards.
• Models risk and regulatory requirements and translates them into actionable obligations and control updates.
• Champions AI governance standards and third‑party risk management across vendors and cloud providers.

Skills

IT governance

Cyber security

Risk management

Regulatory compliance

Leadership

Education

Bachelor's degree in Information Systems, Computer Science, Business or related field

Tools

ServiceNow GRC

Archer

Job description

SVP & Director of IT Governance - Cyber Security

#61-9710

Location

This position is 100% remote within the Bank's footprint. Employee will work full time remote outside of a WesBanco location (may occasionally attend in person meetings, although primary functions of the role are performed remotely).

Market

Mid-Atlantic

40

Requirements

Bachelor’s degree in Information Systems, Computer Science, Business, or related field and/or equal education or experience required

Minimum of 10 years of progressive experience in IT risk, GRC, cybersecurity, or technology audit required.

Minimum of 3 years in a leadership or program management required.

Minimum of 5 years of experience in a regulated financial institution (bank, credit union, or bank holding company); community or regional bank experience preferred.

Professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Systems Manager (CISM), Certified Information Systems Auditor (CISA), or Certified Risk & Information Systems Control (CRISC) are desirable.

Job Description

SUMMARY:

Provides strategic leadership and operational oversight of the Bank's technology governance, risk management, and compliance (GRC) program. Serves as a primary liaison among Technology, Risk, Audit, and executive leadership to ensure the technology risk posture aligns to regulatory expectations, enterprise risk appetite, and industry frameworks. Requires deep expertise in banking technology regulations, enterprise risk frameworks, and control design, balanced with the executive presence to communicate complex risk themes to technical and non-technical audiences, including Board-level committees.

ESSENTIAL DUTIES AND RESPONSIBILITIES:

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Owns and matures the enterprise IT GRC program, including policies, standards, procedures, and control frameworks aligned to NIST CSF 2.0, CIS Controls v8, FFIEC CAT/Architecture, and applicable regulatory guidance (OCC, FDIC, Federal Reserve).

Establishes and maintains the technology policy hierarchy (policy → standard → procedure → control) with defined ownership and periodic review cadence.

Serves as program owner for the technology governance council structure (e.g., IT Steering, Technology Risk), including agenda-setting, reporting, and action item tracking.

Operationalizes AI governance standards (NIST AI RMF, ISO/IEC 42001), including AI inventory, risk tiering, lifecycle controls, and oversight of vendor AI use cases.

Directs the enterprise technology risk assessment program (annual and event-driven) across infrastructure, applications, data, cloud, and third‑party environments; ensure methodology aligns to ERM/RCSA and risk appetite.

Maintains and evolves the IT risk register, including risk identification, scoring, ownership, treatment plans, and risk acceptance/exception workflows.

Leads risk assessment and advisory activities for emerging technologies (AI/ML, cloud, RPA), translating technical exposures into business impact and decision options.

Develops and reports technology risk metrics and KRIs for senior leadership and Board committees; drive a data‑driven risk culture.

Serves as the primary IT GRC point of contact for regulatory examinations (OCC, FDIC, Federal Reserve) and internal/external audit engagements related to technology, cybersecurity, and operational risk.

Monitors and interprets evolving regulatory requirements and supervisory guidance (FFIEC, SR letters, OCC bulletins, GLBA Safeguards, privacy laws) and translate them into actionable obligations and control updates.

Manages technology audit and exam finding remediation: track issue aging, validate evidence, and ensure sustainable control improvements with clear ownership and timelines.

Partners cross‑functionally to support intersecting risk programs (e.g., model risk governance/SR 11‑7 alignment, BSA/AML technology controls, and data governance) as applicable.

Leads the technology and cybersecurity components of Third‑Party Risk Management (TPRM), including onboarding due diligence, periodic reviews, and ongoing monitoring for critical/high‑risk vendors.

Defines vendor risk tiering criteria and control requirements for SaaS, cloud, and AI providers; ensure contract provisions address security, privacy, SLAs, and right‑to‑audit.

Coordinates with Procurement and Legal to ensure contractual risk provisions (e.g., DPA, data handling, incident notification) are implemented and enforced.

Design and implement a continuous controls monitoring (CCM) approach leveraging GRC tooling to automate evidence collection, control attestations, and targeted testing.

Oversees control self‑assessments (CSA) across IT domains (identity and access management, change management, vulnerability management, data protection) and validate remediation effectiveness.

Partners with Cybersecurity on security control maturity assessments (CIS Controls, NIST SP 800‑53) and annual FFIEC CAT completion.

Leads or co‑leads the annual SOC 1/SOC 2 review process for material service providers and support SOX ITGC scoping, testing coordination, and remediation tracking (as applicable).

Builds, leads, and mentors a team of GRC analysts/specialists; establish performance expectations, succession coverage, and professional development pathways.

Drives GRC tool strategy and platform optimization (e.g., ServiceNow GRC, Archer, or equivalent) to enable scalable risk and compliance workflows.

Develops and manages the IT GRC program budget, including tooling, vendor contracts, and staffing plans.

Champions a risk‑aware culture through executive communications, training, and proactive engagement with Technology and business teams.

OTHER REQUIREMENTS:

Banking is a highly regulated industry and you will be expected to acquire and maintain a proficiency in the Bank's policies and procedures, and adhere to all laws, rules and regulations that are applicable to your conduct and the work you will be performing. You will also be expected to complete all assigned compliance training in a timely manner.

Proficient in Microsoft Office products including Outlook, Word, PowerPoint and Excel.

Deep working knowledge of FFIEC IT Examination Handbook, NISTCSF ,CISControls ,, and NIST SP 800-63B.

Strong familiarity with AI governance frameworks including NIST AI RMF and ISO/IEC 42001.

Proficiency with ITGC/SOX (as applicable) and SOC 2 review processes.

Working knowledge of cloud risk and compliance considerations (AWS, Azure, or GCP) and shared responsibility models.

Experience configuring and operating GRC platforms (ServiceNow, Archer, or equivalent).

Understanding of networking concepts (e.g., firewalls, VPNs, DNS) and security protocols (e.g., TLS, SSH).

Ability to learn other banking systems.

Ability to manage or materially contribute to regulatory examinations and audit cycles, including remediation of findings.

Ability to learn new technologies and keep up with industry trends.

Professional demeanor in appearance, interpersonal relations, work ethic and attitude.

Ability to interact effectively across all levels of the organization.

Demonstrated ability to manage multiple priorities and delegate effectively to meet critical deadlines under difficult time restraints.

Understanding of account documentation and retention requirements.

Excellent verbal and written skills and presentation skills with the ability to define and solve problems.

Team player with a positive outlook.

Demonstrated leadership ability and skills.

Ability to work independently and meet communicated deadlines.

Excellent analytical, problem‑solving and decision‑making skills.

Willingness to travel quarterly for onsite meetings.

ADDITIONAL INFORMATION:

The wage range for the SVP & Director of IT Governance position is $150,000 - $160,000 annually and is eligible for transition bonus and incentives. The position includes 27 days of PTO (Paid Time Off) and 5 days of STD (Short Term Disability) and 11 annual paid holidays.

WesBanco has an excellent benefits package to include medical, dental, and vision, Health Care Flexible Spending, Dependent Care Flexible Spending, Transportation Fringe Benefit Plan, Group Life, Long Term Disability, Optional Life, access to voluntary benefit products such as Cancer, Term & Universal Life, Accident, Short‑Term Disability and Critical Illness policies, and other ancillary benefit products. WesBanco also offers 401(k) with employee match.

Full-Time/Part-Time

Full-time

Area of Interest

Information Technology

All Locations

undefined

WesBanco is an Equal Opportunity, ... EOE/Disabled/Veteran
We endeavor to make this site accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact 304-905-7056 or [e-mail] .