Supports enterprise GRC and ERM programs, including risk and control self-assessments, policy governance, issue management, control improvement, KRI monitoring, and executive reporting. Partners with business units to document risks, controls, and remediation activities; analyzes incidents and audit findings; supports regulatory exams and governance forums; and maintains exam-ready documentation aligned with supervisory expectations.

Lead and mature the enterprise information security program, oversee cybersecurity operations, GRC, risk management, IAM, vulnerability and third-party risk programs, ensure regulatory compliance, drive incident response and cyber resilience, and advise executive leadership and the Board on security strategy and investments.