Information Security Governance & Risk Officer

OVERVIEW

BankNewport celebrates being a community bank since 1819. Offering new and exciting career opportunities, BankNewport is committed to providing our employees the resource and guidance to develop careers that are challenging and rewarding.

So if you’re looking for a great professional opportunity, know that BankNewport will empower and invest in you.

The Information Security Governance & Risk Officer leads the Bank’s information security governance, risk, compliance, resiliency, awareness, and assurance programs. Reporting to the Chief Information Security Officer and working alongside the Information Security Operations Officer, the role provides independent oversight of vendor and technology risk, risk assessments, policy governance, audits and examinations, issue remediation, business continuity and disaster recovery, security awareness and phishing testing, governance metrics, and related regulatory obligations.

The role translates regulatory, policy, and risk requirements into practical oversight, remediation, and reporting. The CISO retains accountability for the Information Security Program, strategy, risk acceptance, major incident command, and executive and Board reporting. Technology, business, vendor, and system owners remain accountable for implementing and operating controls.

RESPONSIBILITIES

GOVERNANCE, RISK, AND CONTROL OVERSIGHT

* Establish consistent governance methods, schedules, documentation, metrics, evidence standards, and issue-management practices across assigned programs.
* Work with the Legal and Compliance teams to translate applicable laws, guidance, Bank policies, risk appetite, and security standards into program requirements, control expectations, reporting, and escalation criteria.
* Provide independent oversight by assessing risks and controls, confirming ownership and timely remediation, validating outcomes, and escalating residual risk. Information Security defines requirements and provides oversight; Technology, business, vendor, and system owners implement and operate controls.

TECHNOLOGY AND THIRD-PARTY RISK MANAGEMENT

* Lead risk methodologies, inventories, scoring, assessment schedules, and reporting for information security, technology, customer information, third parties, cloud services, projects, business changes, and emerging risks.
* Coordinate stakeholder assessments of threats, vulnerabilities, control effectiveness, business impact, data sensitivity, criticality, dependencies, third-party exposure, compensating controls, and residual risk; recommend treatment.
* Lead Information Security due diligence and ongoing third-party oversight, including onboarding, risk tiering, periodic and material-change reviews, contractual and resiliency requirements, issue follow-up, and offboarding.
* Maintain an integrated register of risks, findings, exceptions, compensating controls, owners, due dates, evidence, and status; coordinate remediation and escalate material, repeat, accepted, or overdue exposure.
* Validate closure through evidence or testing, identify themes and priorities, and maintain audit-ready risk records and recommendations for management, committees, examinations, and independent review.

AUDIT, EXAMINATION, COMPLIANCE, AND CONTROL ASSURANCE

* Define Information Security scope, priorities, and engagement for audits, regulatory examinations, independent assessments, and control testing assigned by the CISO.
* Coordinate requests, interviews, evidence, responses, action plans, status tracking, and closure; maintain audit-ready records of ownership, approvals, exceptions, testing, remediation, and reporting.
* Map regulatory and framework requirements to policies, risks, controls, owners, evidence, and testing; identify gaps and recommend improvements.
* Monitor relevant laws, guidance, examination expectations, and industry practices and assess their impact on the Information Security Program.

POLICY, STANDARDS, AND GOVERNANCE LIFECYCLE

* Coordinate the lifecycle of assigned information security policies, standards, methodologies, procedures, and governance documents, including drafting, review, approval, publication, acknowledgment, exceptions, and periodic review. The CISO remains the designated policy owner where applicable.
* Keep governance documents aligned with the Bank’s risk profile, operating model, regulatory obligations, supporting procedures, and control practices, with clear ownership, review dates, approvals, revision history, mappings, and exception records.
* Partner with the CISO, Legal, Compliance, Enterprise Risk Management, Technology, Human Resources, and business stakeholders to resolve interpretation and implementation questions.

BUSINESS CONTINUITY, DISASTER RECOVERY, AND OPERATIONAL RESILIENCE

* Lead Information Security oversight of the Business Continuity Program and operational resilience, including business impact analyses, plan governance, dependencies, testing, exercises, issues, and reporting.
* Coordinate with business owners, Technology, Facilities, vendors, Crisis Management, and other stakeholders to maintain recovery requirements, plans, objectives, contacts, dependencies, and testing evidence.
* Assess disaster recovery test scope, results, exceptions, lessons learned, and remediation; report material risks and recommendations without assuming responsibility for Technology implementation or business-owned recovery procedures.

SECURITY AWARENESS, PHISHING TESTING, AND CULTURE

* Own the Bank’s information security awareness and training program, including annual and role-based training, targeted education, policy communications, campaigns, and employee guidance.
* Lead phishing and social-engineering testing, including scenarios, execution, analysis, follow-up education, exceptions, metrics, improvement actions, and escalation.
* Use risk trends, incidents, audit findings, employee feedback, threat intelligence, and business changes to refine priorities.

AI AND EMERGING-TECHNOLOGY GOVERNANCE

* Support the CISO’s governance of artificial intelligence, automation, cloud services, and emerging capabilities through inventories, intake, risk tiering, assessments, approvals, exceptions, KRIs, documentation, and lifecycle review.
* Coordinate cross-functional assessment of security, privacy, regulatory, third-party, resiliency, human-oversight, and operational risks; monitor compliance and maintain review evidence.
* Escalate high-risk use cases, control gaps, exceptions, and residual-risk decisions requiring CISO or executive authority.

INCIDENT RESPONSE GOVERNANCE AND SUPPORT

* Maintain incident response governance, including plans, roles, escalation criteria, regulatory and contractual requirements, exercises, lessons learned, and corrective actions.
* Support the CISO and Security Operations during incidents by coordinating governance activities, maintaining decision and evidence records, tracking notifications and commitments, and assisting with management, regulatory, audit, and committee reporting.
* Provide governance and risk support without assuming the CISO’s incident-command authority or Security Operations’ technical-response responsibilities.

LEADERSHIP, PEOPLE MANAGEMENT, REPORTING, AND BUSINESS PARTNERSHIP

* Set priorities, coordinate dependencies, remove delivery obstacles, and drive consistent execution and improvement across governance and risk initiatives.
* Supervise, coach, prioritize work, review quality, manage performance, and develop assigned Information Security staff, including building the Information Security Analyst’s GRC and backup capabilities.
* Prepare concise dashboards, KRIs, risk statements, committee materials, status updates, and recommendations for the CISO, management, auditors, examiners, and governance bodies.
* Build effective relationships across Technology, Risk Management, Compliance, Legal, Procurement, Human Resources, Internal Audit, Finance, business units, vendors, and service providers.

View and apply on HireChats