Information Security Governance & Risk Officer

Overview

BankNewport celebrates being a community bank since 1819. Offering new and exciting career opportunities, BankNewport is committed to providing our employees the resource and guidance to develop careers that are challenging and rewarding.

So if you’re looking for a great professional opportunity, know that BankNewport will empower and invest in you.

The Information Security Governance & Risk Officer leads the Bank’s information security governance, risk, compliance, resiliency, awareness, and assurance programs. Reporting to the Chief Information Security Officer and working alongside the Information Security Operations Officer, the role provides independent oversight of vendor and technology risk, risk assessments, policy governance, audits and examinations, issue remediation, business continuity and disaster recovery, security awareness and phishing testing, governance metrics, and related regulatory obligations.

The role translates regulatory, policy, and risk requirements into practical oversight, remediation, and reporting. The CISO retains accountability for the Information Security Program, strategy, risk acceptance, major incident command, and executive and Board reporting. Technology, business, vendor, and system owners remain accountable for implementing and operating controls.

Responsibilities

Governance, Risk, and Control Oversight

• Establish consistent governance methods, schedules, documentation, metrics, evidence standards, and issue-management practices across assigned programs.
• Work with the Legal and Compliance teams to translate applicable laws, guidance, Bank policies, risk appetite, and security standards into program requirements, control expectations, reporting, and escalation criteria.
• Provide independent oversight by assessing risks and controls, confirming ownership and timely remediation, validating outcomes, and escalating residual risk. Information Security defines requirements and provides oversight; Technology, business, vendor, and system owners implement and operate controls.

Technology and Third-Party Risk Management

• Lead risk methodologies, inventories, scoring, assessment schedules, and reporting for information security, technology, customer information, third parties, cloud services, projects, business changes, and emerging risks.
• Coordinate stakeholder assessments of threats, vulnerabilities, control effectiveness, business impact, data sensitivity, criticality, dependencies, third-party exposure, compensating controls, and residual risk; recommend treatment.
• Lead Information Security due diligence and ongoing third-party oversight, including onboarding, risk tiering, periodic and material-change reviews, contractual and resiliency requirements, issue follow-up, and offboarding.
• Maintain an integrated register of risks, findings, exceptions, compensating controls, owners, due dates, evidence, and status; coordinate remediation and escalate material, repeat, accepted, or overdue exposure.
• Validate closure through evidence or testing, identify themes and priorities, and maintain audit-ready risk records and recommendations for management, committees, examinations, and independent review.

Audit, Examination, Compliance, and Control Assurance

• Define Information Security scope, priorities, and engagement for audits, regulatory examinations, independent assessments, and control testing assigned by the CISO.
• Coordinate requests, interviews, evidence, responses, action plans, status tracking, and closure; maintain audit-ready records of ownership, approvals, exceptions, testing, remediation, and reporting.
• Map regulatory and framework requirements to policies, risks, controls, owners, evidence, and testing; identify gaps and recommend improvements.
• Monitor relevant laws, guidance, examination expectations, and industry practices and assess their impact on the Information Security Program.

Policy, Standards, and Governance Lifecycle

• Coordinate the lifecycle of assigned information security policies, standards, methodologies, procedures, and governance documents, including drafting, review, approval, publication, acknowledgment, exceptions, and periodic review. The CISO remains the designated policy owner where applicable.
• Keep governance documents aligned with the Bank’s risk profile, operating model, regulatory obligations, supporting procedures, and control practices, with clear ownership, review dates, approvals, revision history, mappings, and exception records.
• Partner with the CISO, Legal, Compliance, Enterprise Risk Management, Technology, Human Resources, and business stakeholders to resolve interpretation and implementation questions.

Business Continuity, Disaster Recovery, and Operational Resilience

• Lead Information Security oversight of the Business Continuity Program and operational resilience, including business impact analyses, plan governance, dependencies, testing, exercises, issues, and reporting.
• Coordinate with business owners, Technology, Facilities, vendors, Crisis Management, and other stakeholders to maintain recovery requirements, plans, objectives, contacts, dependencies, and testing evidence.
• Assess disaster recovery test scope, results, exceptions, lessons learned, and remediation; report material risks and recommendations without assuming responsibility for Technology implementation or business-owned recovery procedures.

Security Awareness, Phishing Testing, and Culture

• Own the Bank’s information security awareness and training program, including annual and role-based training, targeted education, policy communications, campaigns, and employee guidance.
• Lead phishing and social-engineering testing, including scenarios, execution, analysis, follow-up education, exceptions, metrics, improvement actions, and escalation.
• Use risk trends, incidents, audit findings, employee feedback, threat intelligence, and business changes to refine priorities.

AI and Emerging-Technology Governance

• Support the CISO’s governance of artificial intelligence, automation, cloud services, and emerging capabilities through inventories, intake, risk tiering, assessments, approvals, exceptions, KRIs, documentation, and lifecycle review.
• Coordinate cross-functional assessment of security, privacy, regulatory, third-party, resiliency, human-oversight, and operational risks; monitor compliance and maintain review evidence.
• Escalate high-risk use cases, control gaps, exceptions, and residual-risk decisions requiring CISO or executive authority.

Incident Response Governance and Support

• Maintain incident response governance, including plans, roles, escalation criteria, regulatory and contractual requirements, exercises, lessons learned, and corrective actions.
• Support the CISO and Security Operations during incidents by coordinating governance activities, maintaining decision and evidence records, tracking notifications and commitments, and assisting with management, regulatory, audit, and committee reporting.
• Provide governance and risk support without assuming the CISO’s incident-command authority or Security Operations’ technical-response responsibilities.

Leadership, People Management, Reporting, and Business Partnership

• Set priorities, coordinate dependencies, remove delivery obstacles, and drive consistent execution and improvement across governance and risk initiatives.
• Supervise, coach, prioritize work, review quality, manage performance, and develop assigned Information Security staff, including building the Information Security Analyst’s GRC and backup capabilities.
• Prepare concise dashboards, KRIs, risk statements, committee materials, status updates, and recommendations for the CISO, management, auditors, examiners, and governance bodies.
• Build effective relationships across Technology, Risk Management, Compliance, Legal, Procurement, Human Resources, Internal Audit, Finance, business units, vendors, and service providers.
• Represent Information Security in delegated meetings, projects, committees, audits, and examinations; provide defined coverage during the CISO’s absence and escalate matters requiring CISO or executive authority.
• Support strategy, budgets, staffing, roadmaps, succession planning, metrics, and measurable triggers for future capability or investment needs.

KNOWLEDGE, SKILLS, AND ABILITIES

• Advanced knowledge of information security governance, enterprise and technology risk, third-party risk, control assurance, issue management, policy governance, audit and examination practices, and operational resilience.
• Knowledge of financial-services laws and guidance, including GLBA, the Interagency Guidelines Establishing Information Security Standards, FFIEC guidance, applicable privacy requirements, and Bank policies.
• Knowledge of the NIST Cybersecurity Framework, NIST AI Risk Management Framework, NICE Framework concepts, and other relevant control and risk frameworks.
• Ability to evaluate SOC reports, assessments, vendor and contractual evidence, controls, resiliency materials, audit findings, and remediation evidence.
• Ability to design sustainable governance processes, set measurable requirements, analyze risk trends, distinguish oversight from implementation, and translate complex requirements into practical action.
• Ability to document defensible conclusions, communicate material issues, influence stakeholders, and maintain accountability for deliverables and remediation.
• Strong leadership, staff development, writing, presentation, analytical, organizational, project-management, judgment, discretion, relationship-management, and learning agility.

Qualifications

• Bachelor’s degree in information security, cybersecurity, risk management, audit, information technology, business, or a related discipline, or equivalent training, certification, and experience.
• Five or more years of progressively responsible experience in information security governance, technology or third-party risk, audit, compliance, business continuity, or a related field.
• Demonstrated experience leading multiple GRC disciplines and producing management or committee reporting, maintaining audit-ready documentation, coordinating remediation, and communicating with senior leaders, auditors, or examiners.
• Experience in financial services or another regulated environment preferred.
• Relevant certifications such as CISA, CISM, CRISC, CISSP, CBCP, or equivalent preferred.
• Prior people-management, team-lead, program-lead, or staff-development experience preferred.

INDEPENDENT ACTION

Works independently within approved policies, standards, risk tolerances, methodologies, and program requirements. Exercises sound judgment in leading assigned governance and risk programs, setting work plans, coordinating stakeholders, challenging unsupported conclusions, and escalating material risks, exceptions, policy deviations, overdue remediation, examination concerns, and decisions requiring risk acceptance or executive authority.

SUPERVISORY SCOPE

Directly supervises assigned Information Security staff, initially the Information Security Analyst, including work prioritization, coaching, quality review, development, performance management, cross-training, continuity planning, and accountability. Provides functional leadership across governance and risk activities but has no authority over Technology or business personnel and does not perform Technology administration.

PHYSICAL REQUIREMENTS

• Travel independently to the position’s primary work location, other Bank properties, and work-related activities or events.
• Effectively communicate and exchange accurate information and ideas.
• Independently operate a computer and office equipment needed to perform the position’s primary functions.
• Sit or stand at a workspace and use a computer or other equipment for prolonged periods.
• Meet the Bank’s applicable hybrid work schedule requirements.
• Move office items weighing up to 35 pounds.
• Work in an environment with low to moderate noise levels.

Additionally, this role may require off hours work, nights and weekends, as cyber threats can emerge at any time.  

BANKNEWPORT CORE VALUES:

• We celebrate individuality
• We empower employees to be creative problem solvers
• We invest and take the time to really get to know our customers
• We commit to serving the financial needs of Rhode Islander’s

All employees of BankNewport are expected to support bank-wide efforts designed to understand, measure, monitor, reduce, control and report risk in the most efficient and cost-effective manner. Risk management includes but is not limited to compliance risk, credit risk, liquidity risk, market risk, operations risk and systems risk as well as attention to physical building safety and security. Furthermore, all support staff employees are expected to fully support the Bank’s “All In” initiative and utilize support staff training to consistently provide sales support to all departments. They should also possess an understanding of their department’s support metrics and continue to improve Bank efficiencies.

Any physical demands or work conditions described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

BankNewport is committed to a policy of Equal Employment Opportunity and will not discriminate against an applicant or employee on the basis of race, color, religion, creed, national origin or ancestry, sex, age, physical or mental disability, veteran or military status, genetic information, sexual orientation, gender identity or expression, pregnancy, childbirth or related medical conditions, military service, marital status, or any other legally recognized protected basis under federal, state or local laws, regulations or ordinances.