CorSource is a technology consulting firm dedicated to turning innovation into a competitive advantage. Our solutions incorporate strategic consultants, subject matter experts, and agile project teams to harness the power of both people and technology. Since 1994, our clients have counted on us for the expertise to develop and implement technology-based solutions. At CorSource, we are driven by a strong set of values, a proven methodology, and a trusted community built on diversity and rewarding relationships. We are all about cultivating long-term connections with the people who work with us and our clients.

Industry: IT Services and IT Consulting
Company Size: 51-200 employees

CorSource

Savvy Admin PROD

**JOB TITLE: **Threat Oversight Officer

**START DATE: **ASAP

**DURATION: **Permanent**, **FTE

**WORK HOURS: **Full time, 40 hours/ week

**LOCATION: **Hybrid (Portland, Seattle, Tacoma, Eugene or Boise)

**TRAVEL: ** Minimal regionally (~10-15%)

**EQUIPMENT/ ACCESS: ** Equipment provided by company

**Role Overview: **

This role critically reinforces our client's second line of defense (2LoD) framework, and is responsible for providing independent oversight, rigorous challenge, and governance of cybersecurity risk across the organization, while ensuring cybersecurity risks are identified, assessed, monitored, and reported, in alignment with the bank's risk appetite, regulatory obligations (GLBA, FFIEC, OCC/FDIC), and industry best practices.

**Role Responsibilities: **

- Oversees and maintains the Cybersecurity Risk Management Framework, aligning to FFIEC, NIST CSF, and the bank’s Information and Cyber Security Program.

- Maintains and continuously updates cyber risk taxonomies, classification models, and impact assessment criteria.

- Independently reviews and challenges 1LoD cybersecurity risk assessments, control self-assessments (CSAs), and remediation plans.

- Provides formal risk opinions on major technology initiatives, digital transformation efforts, and cloud or third[1]party onboarding

- Leads and/or supports thematic reviews of cybersecurity initiatives and emerging risk areas (e.g., zero trust architecture, multi-factor authentication (MFA) implementation, and AI usage) to evaluate risk exposure, control effectiveness, and alignment with security standards.

- Develops and maintains cybersecurity risk metrics and key risk indicators (KRIs) to ensure alignment with the organization’s risk appetite.

- Prepares and delivers executive and board-level risk reporting, highlighting trends, emerging threats, and control gaps.

- Leads and oversees the annual planning of security testing activities to ensure appropriate coverage of key systems and risks.

- Reviews and monitors risk acceptances, control exceptions, audit/regulatory findings, and enforce timely remediation of items. Ensures risk acceptance processes include clear compensating controls, expiration timelines, and documented approvals.

- Provides independent cyber risk oversight for third-party vendors, especially those handling sensitive data or key infrastructure.

- Supports cybersecurity components of internal audits and regulatory examinations (e.g., FDIC, OCC, FFIEC).

- Leads and manages the organization's Threat Intelligence program and Information and Cyber Security Council.

- Maintains up-to-date understanding of evolving cybersecurity regulatory expectations.

**Qualifications: **

- Provide an exceptional level of service for internal and external customers, with the ability to build and maintain positive, professional relationships, to successfully interact with all levels of management and functional and cross-functional areas across the organization.

- Excellent listening, verbal, written, and visual communication skills, with the ability to translate complex risk information into clear, actionable reporting and presentations for technical and non-technical audiences. Ability to read, write, speak, and understand English well.

- Strategic in approach to problem solving and decision-making, with demonstrated ability to quickly focus on key issues and make decisions under pressure of time constraints.

- Strong analytical and critical thinking skills, with the ability to independently assess risk decisions and constructively challenge first-line assumptions and conclusions.

- Thorough knowledge and understanding of cybersecurity and regulatory frameworks, including NIST CSF, FFIEC guidance, ISO 27001/27005, SOX, and GLBA/Interagency Guidelines.

- Knowledge of the Three Lines of Defense operating model and its application in enterprise risk management, including coordination among business operations, independent risk oversight, and internal audit functions.

- Strong planning, organizational, time management, and follow-up skills, demonstrating a strong sense of urgency and ability to execute quickly, timely and efficiently; independently ensuring that priorities are set and commitments and deadlines are met with minimal direction and oversight.

- Unquestionable integrity in handling sensitive and confidential information required.

- Proficient and advanced use and understanding of MS Office products (Word, Excel, Outlook), with the ability to adapt to and learn new technologies quickly.

**Required Skills and Experience: **

- 5+ years of recent and progressive knowledge and experience in a cybersecurity, IT risk management, or audit role within a financial services environment required.

- Professional certifications as Global Information Assurance Certification (GIAC), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Microsoft Azure or equivalent preferred.

- Equivalent combination of education, training, certifications, and/or relevant work experience may be considered

Threat Oversight Officer

Find Risk Management jobs in Portland, Oregon Metropolitan Area with Savvy's AI Recruiter. Browse opportunities from top companies and get matched with roles that match your skills using our intelligent recruitment system.