Information Security Audit & Regulatory Specialist

SMBC Group is a top-tier global financial group. Headquartered in Tokyo and with a 400-year history, SMBC Group offers a diverse range of financial services, including banking, leasing, securities, credit cards, and consumer finance. The Group has more than 130 offices and 80,000 employees worldwide in nearly 40 countries. Sumitomo Mitsui Financial Group, Inc. (SMFG) is the holding company of SMBC Group, which is one of the three largest banking groups in Japan. SMFG’s shares trade on the Tokyo, Nagoya, and New York (NYSE: SMFG) stock exchanges.

In the Americas, SMBC Group has a presence in the US, Canada, Ireland, Mexico, Brazil, Chile, Colombia, and Peru. Backed by the capital strength of SMBC Group and the value of its relationships in Asia, the Group offers a range of commercial and investment banking services to its corporate, institutional, and municipal clients. It connects a diverse client base to local markets and the organization’s extensive global network. The Group’s operating companies in the Americas include Sumitomo Mitsui Banking Corp. (SMBC), SMBC Nikko Securities America, Inc., SMBC Capital Markets, Inc., JRI America, Inc., SMBC Leasing and Finance, Inc., Banco Sumitomo Mitsui Brasileiro S.A., and Sumitomo Mitsui Finance and Leasing Co., Ltd.

• This is a hybrid role, requiring the successful candidate to attend our Tralee office at least three (3) days in a work week.

Role Description

SMBC is seeking an experienced Audit & Regulatory Management (ARM) Manager to join the Cybersecurity Governance, Risk and Compliance organization, with a primary focus on cybersecurity-related regulatory responses and attestations.

This hands-on role will drive and coordinate the end-to-end preparation of cybersecurity regulatory enquiries, examinations and information requests from receipt through final submission, partnering with Cybersecurity subject matter experts, Control Owners, senior management and other stakeholders to deliver accurate, complete and timely responses.
The ARM Manager will also support attestations of adherence to applicable cybersecurity requirements and strengthen regulatory readiness through effective processes, reusable evidence and consistent stakeholder engagement.

This is not an Internal Audit role. However, experience in audit, assurance, regulatory examinations, cybersecurity risk or assessment activities would be advantageous.

Role Objectives: Delivery

• Manage cybersecurity regulatory enquiries, examinations, information requests and follow-up questions from receipt through final submission.
• Translate regulatory requests into clear requirements and coordinate timely input from Cybersecurity SMEs, Control Owners and Evidence Providers.
• Review draft responses and supporting evidence to identify gaps, inconsistencies, unsupported assertions, and matters requiring clarification before management review, approval, and submission. Ensure responses are validated.
• Support cybersecurity regulatory attestations by coordinating, reviewing, and challenging, where appropriate, the information and evidence underpinning management representations.
• Maintain clear visibility of response status, deadlines, dependencies, exceptions and matters requiring management attention or escalation.
• Support regulatory readiness by maintaining reusable evidence, identifying recurring requirements and improving preparedness for future engagements.
• Build effective stakeholder relationships and drive continuous improvement in ARM standards, templates, tools and response processes.

Qualifications and Skills

• Bachelor's degree in Information Technology, Information Security, Cybersecurity, Risk Management or a related field, or equivalent relevant professional experience.
• Five or more years’ experience in cybersecurity risk, regulatory response, technology risk, audit, assurance or consulting.
• Experience supporting regulatory examinations, information requests or regulatory attestations within a financial services or similarly regulated environment.
• Strong understanding of cybersecurity controls, technology risk and regulatory expectations.
• Working knowledge of cybersecurity and technology-risk regulatory expectations and industry frameworks, including, as applicable, the NYSDFS Cybersecurity Regulation, NIST Cybersecurity Framework, ISO/IEC 27001/27002, and relevant U.S. banking regulatory guidance.
• Professional certifications such as CISA, CISSP, CISM or CRISC are desirable.
• Strong analytical skills with the ability to review regulatory responses and supporting evidence critically.
• Ability to distinguish between an assertion and the evidence required to substantiate it.
• Excellent written and verbal communication skills, including the ability to translate complex cybersecurity matters into clear, concise and defensible regulatory responses.
• Strong stakeholder management skills and confidence working with senior management, Control Owners and technical SMEs.
• Ability to manage multiple regulatory requests and deadlines simultaneously while maintaining a high standard of quality and attention to detail.
• Self-motivated, organized and able to independently drive activities through to completion.

SMBC’s employees participate in a hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process.

SMBC provides reasonable accommodations during candidacy for applicants with disabilities consistent with applicable federal, state, and local law. If you need a reasonable accommodation during the application process, please let us know at accommodations@smbcgroup.com.