Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowFirst seen 3 hours ago

Technology Risk, Cyber Governance & Third-Party Risk Manager

BankUnited89 open roles

Where
Miami Lakes, FL, USA
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowTechnology Risk, Cyber Governance & Third-Party Risk ManagerBankUnited · Miami Lakes, FL, USA

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on BankUnited's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

11.3% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.0%1 day
  2. 4.3%3 days
  3. 11.3%7 days
  4. 17.5%14 days
  5. 34.2%30 days
  6. 43.5%60 days
This job: first seen 3 hours ago

The posting

JOB SUMMARY

This position is responsible for providing independent second-line oversight of technology, cybersecurity, third-party, cloud, and emerging technology risks across the organization. The role serves as a trusted advisor and challenge function to Information Technology, Information Security, Enterprise Architecture, Procurement, Legal, Compliance, Enterprise Risk Management, and business stakeholders.

The incumbent leads cybersecurity third-party risk management activities, performs independent risk assessments, evaluates technology control environments, reviews technology and security architectures, and provides governance oversight of technology initiatives and vendor relationships. The position is responsible for identifying, assessing, monitoring, and communicating technology-related risks while ensuring alignment with the organization's risk appetite, regulatory requirements, and industry best practices.

This role also supports regulatory examinations, internal and external audits, enterprise risk reporting, technology governance forums, and ongoing enhancement of technology risk and third-party risk management programs.

ESSENTIAL DUTIES AND RESPONSIBILITIES

  • Technology Risk Governance & Second-Line Oversight: Serves as an independent Second Line of Defense (2LOD) challenge function for technology, cybersecurity, cloud, data, AI, and third-party risks. Provides objective review and challenge of technology initiatives, cybersecurity programs, system implementations, and vendor onboarding activities. Assesses whether proposed controls, architectures, and risk mitigation strategies are appropriately designed and commensurate with organizational risk. Evaluates risk acceptance requests, compensating controls, documented exceptions, and remediation plans. Ensures technology risks remain within approved risk appetite thresholds. Participates in governance committees, steering committees, risk forums, and working groups as a technology risk subject matter expert. Advises management regarding technology risk, cybersecurity risk, operational risk, and third-party risk implications.
  • Cybersecurity Third-Party Risk Management: Leads cybersecurity due diligence reviews for new and existing third-party relationships. Evaluates vendor security controls through reviews of SOC reports, ISO certifications, SIG questionnaires, audit reports, penetration tests, security policies, regulatory documentation, and other independent attestations. Assesses vendor risks associated with cloud hosting, managed services, software development, professional services, artificial intelligence, critical infrastructure, and data processing. Evaluates subcontractor and fourth-party dependencies and associated risks. Reviews third-party incidents, breaches, control failures, and operational disruptions for potential impacts to the organization. Develops cybersecurity due diligence opinions and risk recommendations for business owners and management. Presents vendor risk assessments and residual risk determinations to stakeholders and governance bodies. Supports ongoing monitoring activities for critical and high-risk third-party relationships.
  • Contract & Third-Party Governance Review: Reviews contractual requirements related to information security, cybersecurity, privacy, resilience, artificial intelligence, business continuity, regulatory compliance, and audit rights. Assesses contractual provisions related to: Breach notification Security obligations Data retention and destruction Subprocessor management Right-to-audit provisions Regulatory cooperation AI model training restrictions Cloud hosting controls Data residency requirements Identifies contractual gaps and recommends risk mitigation strategies. Collaborates with Legal, Procurement, Compliance, and business stakeholders during contract negotiations.
  • Technology Risk Assessments: Performs risk assessments for applications, systems, technologies, cloud implementations, and technology projects. Assess cybersecurity, operational, regulatory, architectural, resilience, and data protection risks. Evaluates security architectures, cloud deployments, integrations, and emerging technologies. Reviews technology designs for alignment with security standards, regulatory guidance, and enterprise control requirements. Identifies control weaknesses, security gaps, and operational risks. Recommends practical risk mitigation strategies and compensating controls.
  • Technology & Security Advisory Services: Provides risk and cybersecurity consultation to technology teams, security teams, architects, project teams, and business stakeholders. Assists teams in understanding regulatory requirements and industry expectations. Supports development of secure and compliant technology solutions. Advises stakeholders on cybersecurity frameworks, cloud security, third-party risk, technology resilience, data protection, and emerging threats. Provides technical guidance during vendor selection, technology implementations, and operational changes.
  • Architecture Review & Security Governance: Participates in Security Review Boards, Architecture Review Boards, and technology governance forums. Reviews proposed technology architectures for risk, security, resilience, recoverability, and compliance considerations. Challenges incomplete documentation, undefined controls, security gaps, unsupported assumptions, and unresolved risks. Ensures technology initiatives maintain appropriate design documentation and evidence of control implementation prior to approval.
  • Risk Program Development: Designs, develops, and enhances technology risk and third-party risk management methodologies. Maintains and improves inherent risk assessment methodologies, questionnaires, and governance processes. Develops standards, procedures, templates, reporting mechanisms, and program documentation. Establishes scalable approaches for cybersecurity assessments, vendor monitoring, and risk reporting. Supports implementation of continuous monitoring capabilities and risk intelligence programs. Evaluates opportunities to improve process efficiency through automation, workflow optimization, and technology solutions.
  • Regulatory, Audit & Examination Support: Supports regulatory examinations and interactions with banking regulators. Coordinates responses to technology risk, cybersecurity, and third-party risk examination requests. Partners with Internal Audit and External Audit during reviews of technology and security controls. Develops management responses, remediation plans, and supporting evidence. Tracks and monitors corrective actions through completion. Supports enterprise compliance efforts related to GLBA, FFIEC guidance, NYDFS, PCI DSS, and other applicable regulations.
  • Risk Reporting & Executive Communications: Develops and presents risk reports, assessments, dashboards, and governance materials. Communicates complex technology risks in a manner understandable to executive leadership and business stakeholders. Prepares examiner-facing and executive-facing documentation. Presents assessment conclusions, residual risks, trends, and recommendations. Contributes to board and management reporting as required.
  • Leadership, Mentorship & Knowledge Sharing: Serves as a subject matter expert for technology risk, cybersecurity governance, and third-party risk management. Provides coaching and guidance to analysts and peers regarding assessment methodologies, evidence evaluation, and risk communication. Promotes consistency, quality, and repeatability within risk management processes. Shares knowledge of regulatory expectations, industry practices, and emerging technology risks.
  • Adheres to and complies with applicable, federal and state laws, regulations and guidance, including those related to anti-money laundering (i.e. Bank Secrecy Act, US PATRIOT Act, etc.).
  • Adheres to Bank policies and procedures and completes required training.
  • Identifies and reports suspicious activity.

SUPERVISORY RESPONSIBILITIES

  • Supervises function, projects or services and/or one or more employees, as applicable.
  • Carries out supervisory responsibilities in accordance with the organization's policies and applicable laws.
  • Responsibilities include interviewing, hiring, and training employees; planning, assigning, and directing work; appraising performance coaching; rewarding and disciplining employees; addressing complaints and resolving problems.

QUALIFICATIONS

Education

  • Bachelor's degree in engineering or computer sciences

Experience

  • 8+ years of experience in one or more of the following: Technology Risk Management Cybersecurity Governance Third-Party Risk Management Information Security Technology Audit Cybersecurity Risk Assessments Regulatory Compliance Enterprise Risk Management
  • Preferred Expertise Technology Risk Governance Cybersecurity Third-Party Risk Management Cloud Security Security Architecture Artificial Intelligence Governance Technology Control Frameworks Regulatory Compliance Vendor Risk Assessments Contract Risk Review Security Operations Business Continuity & Operational Resilience

Licenses and Certifications

  • Certifications such as CISSP (Certified Information Systems Security Professional), CISA (Certified Information Systems Auditor), CRISC (Certified in Risk and Information Systems Control), and CC (Certified in Cybersecurity) are highly preferred.

Knowledge, Skills, and Abilities

  • Frameworks & Regulatory Knowledge
  • Demonstrated expertise in: NIST Cybersecurity Framework NIST SP 800 Series FFIEC Guidance GLBA Safeguards Rule COBIT ISO 27001 ISO 42001 PCI DSS NYDFS Cybersecurity Regulation Third-Party Risk Management Guidance

Additional Information

  • Candidates residing in locations within BankUnited's footprint may be given preference.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against BankUnited's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on BankUnited's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    BankUnited's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.