Risk Manager, Information Security, Business Resilience and Third Party Risk Management

Job Title: Risk Manager IT, Information Security, Business Resilience and Third Party Risk Management

Department: Risk Management

Location: New York

Corporate Title: Executive Director

The pay range for this position at commencement of employment is expected to be between $220,000 to $270,000 per year (see below footnote for additional compensation and benefits information).

Company overview

Nomura is a financial services group with an integrated global network. By connecting markets East & West, we service the needs of individuals, institutions, corporates and governments through our four business divisions: Wealth Management, Investment Management, Wholesale (Global Markets and Investment Banking) and Banking.

Driven by the insights of some 28,000 people worldwide, we put our clients at the center of everything we do, delivering unparalleled access to, from and within Asia. For further information about Nomura, visit www.nomura.com

Aon’s Benefit Index®, Nomura’s benefits rank #1 amongst our competitors

Department Overview:

Risk Management supports Nomura to achieve its business goals by partnering with business units across the firm, providing independent advice to the Board and protecting the firm from exposure to losses as a result of credit, market, operational and other risks. 

The Operational Risk Management (ORM) 2LoD function is part of the Risk Management organization and is responsible for:

• Developing operational risk frameworks and policies
• Providing independent oversight over operational risks and challenging First Line of Defense
• Monitoring risk appetite compliance
• Reporting to senior management and committees

Key Responsibilities:

In this role, you will be the second line of defense risk manager overseeing Nomura Information Technology and Information Security (IT & IS), Business Resilience as well as Third Party risks (TPRM). You will focus on:

• Check and Challenge the ICT risk profile of the Americas operations as well as participate in risk management programs for Nomura globally

• Provide independent risk opinions on compliance with relevant regulatory and industry expectations (NIST, FFIEC…)
• Review the risk profile across IT change management, identity and privileged access (IAM/PAM), resilience, vulnerability and patch management, data leakage prevention, etc.
• Review and challenge the 1LoD controls rollout and results.
• Produce and/or contribute to management dashboard, focusing on remediation action when needed.
• Review and Challenge the Business Continuity Management (BCM) program (BCP, testing…).

• Third-Party risk oversight
  • Assess independently the adherence to industry and regulatory standards e.g. interagency guidance
  • Review the proper tiering of TPs, due diligence standards, monitoring of risk acceptances…
  • Independently challenge criticality and materiality designations, with particular focus on material outsourcing and intragroup service arrangements

Required Qualifications:

• 15+ years in a technical role along with exposure to / experience in technology risk management, information security, or IT audit.
• Bachelor's degree in computer science, engineering, or information systems; CISSP, CISA, CISM, CRISC, or CCSP preferred.
• Hands-on technical experience in engaging 1LoD experts on technical issues.
• Experience in proactively sustaining independent check and challenges with first line.
• Understanding of Industry standards and regulatory expectations, with experience implementing or auditing IT and IS risk compliant framework.

Nomura Leadership Behaviors

• Explore Insights & Vision: Identify the underlying causes of problems faced by you or your team and define a clear vision and direction for the future.
• Making Strategic Decisions: Evaluate all the options for resolving the problems and effectively prioritize actions or recommendations.
• Inspire Entrepreneurship in People: Inspire team members through effective communication of ideas and motivate them to actively enhance productivity.
• Elevate Organizational Capability: Engage proactively in professional development and enhance team productivity through the promotion of knowledge sharing.
• Inclusion: Foster a culture of inclusion and psychological safety in the workplace and cultivate a "Risk Culture" (Challenge, Escalate and Respect).

* base pay offered may vary depending on multiple individualized factors, including market location, corporate and functional title and duties, job-related knowledge and advanced degrees, skills, and experience. The total compensation package for this position may also include other elements, including a sign-on bonus, restricted stock units, and discretionary awards in addition to a full range of medical, financial, and/or other benefits (including 401(k) eligibility and various paid time off benefits, such as vacation, sick time, and parental leave), dependent on the position offered. Details of participation in these benefit plans will be provided if an employee receives an offer of employment.

If hired in the U.S., employee will be in an “at-will position” and the Company reserves the right to modify base salary (as well as any other discretionary payment or compensation program) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors”.

Nomura is an Equal Opportunity Employer