Risk Treatment

SMBC Group is a top-tier global financial group. Headquartered in Tokyo and with a 400-year history, SMBC Group offers a diverse range of financial services, including banking, leasing, securities, credit cards, and consumer finance. The Group has more than 130 offices and 80,000 employees worldwide in nearly 40 countries. Sumitomo Mitsui Financial Group, Inc. (SMFG) is the holding company of SMBC Group, which is one of the three largest banking groups in Japan. SMFG’s shares trade on the Tokyo, Nagoya, and New York (NYSE: SMFG) stock exchanges. In the Americas, SMBC Group has a presence in the US, Canada, Mexico, Brazil, Chile, Colombia, and Peru. Backed by the capital strength of SMBC Group and the value of its relationships in Asia, the Group offers a range of commercial and investment banking services to its corporate, institutional, and municipal clients. It connects a diverse client base to local markets and the organization’s extensive global network. The Group’s operating companies in the Americas include Sumitomo Mitsui Banking Corp. (SMBC), SMBC Nikko Securities America, Inc., SMBC Capital Markets, Inc., JRI America, Inc., SMBC Leasing and Finance, Inc., Banco Sumitomo Mitsui Brasileiro S.A., and Sumitomo Mitsui Finance and Leasing Co., Ltd. GRC Issue Management VP SMBC is seeking an experienced Cyber Governance, Risk and Compliance professional with 7+ years of experience in Cybersecurity, Information Security, Risk Management, Audit, Regulatory Compliance, and Issue Management. The successful candidate will possess a strong understanding of cybersecurity governance practices, issue remediation, audit management, control validation, and executive reporting within a complex financial services environment. This role will serve as a key leader within the Risk Treatment Team (RTT), responsible for driving Cybersecurity's Issue Management and Closure Program. The individual will oversee the lifecycle management of audit, regulatory, and self-identified issues from issue intake and creation through remediation validation and closure. Working closely with Issue Owners, Subject Matter Experts (SMEs), Internal Audit, and Regulatory stakeholders, the role will ensure remediation activities are adequately documented, evidence packages meet validation expectations, and issues are closed in a timely and sustainable manner. A primary responsibility of this position is to establish strong governance, reporting, and tracking mechanisms that provide transparency into issue status, closure performance, remediation progress, and emerging risks. The successful candidate will develop executive-level reporting for the CISO and Cybersecurity leadership team, monitor issue closure trends, identify obstacles to successful remediation, and escalate issues that are at risk of missing commitments, failing validation reviews, or requiring management intervention. The role will also be responsible for driving consistency across issue management processes, improving closure quality, strengthening accountability among stakeholders, and ensuring risks associated with delayed or ineffective remediation are appropriately escalated and managed. This position reports to the Head of Risk Treatment within Cyber Governance, Risk and Compliance and offers the opportunity to lead a critical function supporting Cybersecurity's risk reduction and control improvement objectives. Issue Management & Closure Governance Lead Cybersecurity's Issue Management and Closure Program , establishing governance, processes, standards, and procedures for the end-to-end management of audit, regulatory, and self-identified issues. Oversee the full issue lifecycle including issue intake, issue creation, remediation tracking, validation, closure approval, and post-closure reporting. Coordinate closure activities across Issue Owners and SMEs , ensuring remediation evidence and supporting documentation meet Internal Audit, Regulatory, and Risk Management validation expectations. Provide effective challenge and quality assurance over remediation evidence packages , ensuring closure requests are complete, sustainable, and supported by sufficient documentation. Audit and Stakeholder Management Serve as the primary liaison between Cybersecurity, Internal Audit, and issue owners , coordinating remediation responses, closure evidence submissions, validation activities, and resolution of audit feedback. Organize and manage audit responses and remediation documentation , ensuring timely delivery, consistency, quality, and accountability across stakeholders. Facilitate issue validation reviews by coordinating evidence collection, SME engagement, audit inquiries, and closure support activities. Reporting, Metrics, and Executive Communication Identify and escalate issues at risk of missing remediation commitments , failing validation reviews, or experiencing significant implementation delays. Drive governance and accountability forums to review remediation progress, closure blockers, validation challenges, and corrective actions. Ensure appropriate escalation of issue management risks to Cybersecurity leadership, Issue Owners, Risk Management, and relevant governance committees. Continuous Improvement Enhance issue management processes, reporting capabilities, and closure validation practices to improve efficiency, transparency, and effectiveness across the Cybersecurity organization. Define business requirements and support implementation of issue management tooling , including workflow automation, evidence repositories, dashboards, metrics, and reporting solutions. Develop and maintain issue management procedures, standards, and lessons learned , promoting consistency and continuous improvement of remediation and closure activities. Qualifications and Skills 7+ years of experience in Cybersecurity, IT Audit, Risk Management, Issue Management, Regulatory Compliance, or Control Governance. Demonstrated experience managing audit findings, regulatory issues, remediation programs, and closure validation activities within the financial services industry. Strong understanding of remediation governance, issue lifecycle management, audit practices, and evidence validation requirements. Experience partnering with Internal Audit, Risk Management, and business stakeholders to drive issue resolution and sustainable remediation. Strong analytical and reporting skills with experience developing executive-level dashboards and management reporting. Proven ability to manage multiple stakeholders, enforce accountability, and escalate risks requiring leadership attention. Experience with governance, risk, compliance, audit, and issue management platforms and reporting solutions. Additional Requirements SMBC’s employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required. SMBC provides reasonable accommodations during candidacy for applicants with disabilities consistent with applicable federal, state, and local law. If you need a reasonable accommodation during the application process, please let us know at .