Reporting to the Chief Information Security Officer and working alongside the Information Security Operations Officer, the role provides independent oversight of vendor and technology risk, risk assessments, policy governance, audits and examinations, issue remediation, business continuity and disaster recovery, security awareness and phishing testing, governance metrics, and related regulatory obligations. Exercises sound judgment in leading assigned governance and risk programs, setting work plans, coordinating stakeholders, challenging unsupported conclusions, and escalating material risks, exceptions, policy deviations, overdue remediation, examination concerns, and decisions requiring risk acceptance or executive authority.