Cyber GRC Reporting Manager - Vice President

1) Who we are

United by a sense of purpose towards our customers – to be a trusted partner for the long-term – and our universal banking platform in EMEA, SMBC Group has an international growth agenda and award-winning products, meaning we provide exciting opportunities to work on a diverse range of projects and initiatives. We deliver a full suite of corporate finance products and solutions to our customers as well as investment banking and advisory services, and a range of innovative solutions in global capital markets. Read on to find out how you could enhance your skills and gain valuable experience, by joining us to support our clients transition to a sustainable future.

Sumitomo Mitsui Finance Dublin Limited (SMFD) is a wholly owned subsidiary of SMBC. It was established in 1989 and is now located in contemporary offices in the heart of Dublin’s Georgian quarter. It is a Centre of Excellence for SMBC’s business in Europe, Middle East & Africa and provides a growing range of intra-group services across a variety of Control and Support functions.

2) Background and purpose

This role sits within the Cyber GRC function in the CISO organisation and is a senior first line delivery role across the EMEA region. The primary focus of the role is Cyber GRC reporting, with particular accountability for the production of clear, consistent and decision ready management, Risk Committee, Executive and Board reporting. This includes the design and operation of mature KRI and management information frameworks, supported by reliable data, analysis and appropriate tooling. While reporting is the main focus, the post holder will also be expected to contribute across the wider Cyber GRC agenda, including governance, risk and control management, regulatory compliance, policy governance, audit and remediation activity, and continuous improvement across EMEA and the wider global operating model.

• Maintain a strong and transparent cyber control environment aligned to regulatory expectations and risk appetite.
• Provide clear visibility of cyber risk, control performance, remediation progress and material issues through robust management, Risk Committee and Board reporting.
• Enable informed decisions through reliable management information, mature KRIs, trend analysis, forward looking insight and structured escalation.
• Drive consistent reporting definitions, data standards and GRC practices across regions, entities, services and cyber domains.

The anticipated salary range for this role is €72,000.00 – €134,000.00, with the final offer determined based on the candidate’s skills, experience, role scope, location, and relevant market factors. In addition to base salary, the role may be eligible for a discretionary incentive award and a competitive benefits package, including core benefits such as pension provision.

3) Principal Accountabilities

Metrics, KRIs and management information

• Own the end to end cyber metrics and management information cycle, including planning, data collection, validation, reconciliation, RAG assessment, attestation, approval and evidence retention.
• Design and maintain Cyber GRC KRIs, KCIs and KPIs with clear definitions, calculation logic, thresholds, escalation triggers, data lineage and accountable owners.
• Provide an integrated view of cyber risk, risk appetite, control effectiveness, issue and action ageing, audit and regulatory commitments, service health and third party exposure.
• Produce trend, variance and root cause analysis that explains changes, their significance, required management attention and decisions.
• Set data quality standards so metrics are consistent, reproducible, traceable and suitable for executive, Board, audit and regulatory scrutiny.
• Use Power BI and approved tools to automate reporting while retaining appropriate controls, approvals, audit trails and clear production ownership.

Management, Risk Committee, Executive and Board reporting

• Lead Cyber reporting for the Security and Technology Risk Committee, covering planning, data requests, pack production, quality assurance, approval, submission, evidence and action follow through.
• Own concise management reporting for senior Cyber and Technology leaders, highlighting performance, material risks, matters outside appetite, control weaknesses, remediation and decisions required.
• Prepare Risk Committee and Board reporting that links risk appetite, KRIs, exposures, control effectiveness, incidents, findings, commitments and management actions in clear business language.
• Provide reviewed Cyber GRC inputs to ORRC, Executive, resilience, entity and Head Office forums in line with agreed requests and templates.
• Coordinate regulatory reporting and information requests, securing accurate, complete, evidenced and approved input from relevant owners within required timescales.
• Maintain consistency, traceability and version control across submissions, and coordinate contributors to resolve data or evidence gaps and secure approval.
• Track decisions, challenges and actions from reporting forums, including ownership, due dates, escalation and evidence backed closure.

Reporting process, tooling and continuous improvement

• Improve Cyber GRC portfolio, service, reporting and evidence processes, including demand intake, prioritisation, workflow, taxonomy and records discipline.
• Maintain a single view of Run and Build activity linked to risks, issues, dependencies, actions, decisions, milestones, deliverables and reporting outputs.
• Lead governed use of Power BI, ServiceNow, SAI360, Power Platform and other approved solutions to improve reporting maturity, auditability and scalability.
• Define service measures, SLAs, quality gates, closure criteria and evidence standards, monitor control failures and drive continuous improvement.

Regulatory compliance and assurance

• Coordinate first line Cyber GRC responses to applicable requirements, including DORA, EBA guidance and entity or Head Office requests.
• Maintain a controlled view of regulatory commitments and dependencies, including scope, ownership, inputs, due dates, evidence, blockers and escalation.
• Translate requirements into practical controls, processes, evidence and accountable actions, maintaining traceability across obligations, policies, controls, risks, findings and remediation.
• Coordinate input from Compliance, Legal, Risk, Head Office, service owners and subject matter experts while preserving their accountability and governance cadence.

4) Additional Responsibilities

Broader responsibilities, as directed by management, to support business, operational and regulatory needs may include:

First line governance and operating model

• Support and improve the first line Cyber GRC framework, operating model, service structure and service catalogue, with clear scope, ownership, decision rights, service levels, measures and evidence requirements.
• Apply clear RACI responsibilities, governance routes, escalation paths, review routes and approval standards across BAU services, projects, commitments, audit actions and reporting outputs.
• Support governance forums with accurate papers, decisions, actions and risk insight, and partner with business, technology and control teams to embed ownership and remediation discipline.

Cyber risk and control management

• Support the identification, assessment, treatment, monitoring, evidencing, validation and closure of first line cyber risks and issues.
• Maintain decision ready visibility across risks, issues, dependencies, actions, decisions, milestones and deliverables, with clear links to risk appetite and regulatory expectations.
• Support control design, operation, testing and evidence, and drive recovery plans and escalation for overdue, Red or Amber items with clear owners, dates and closure criteria.

Policy and standards governance

• Lead the review and governance of cyber policies and standards, maintaining alignment with regulatory requirements, internal frameworks and control obligations.
• Coordinate owners, reviewers and approvers through the policy lifecycle and annual approval cycle, and manage exceptions through documented risk assessment, controls, approval and review dates.
• Support policy uplift activity, including ECB related requirements, cyber skills framework operationalisation and associated process governance.

Audit and remediation management

• Act as a senior first line contact for Internal and External Audit, coordinating engagement, document requests, evidence, stakeholder responses and governance updates.
• Support agreement and tracking of practical remediation actions with accountable owners, due dates, closure criteria and validation requirements through to evidence backed closure.
• Identify recurring themes, use audit outcomes to improve controls and evidence quality, and clarify accountability where audit management ownership is shared or unclear.

Stakeholder leadership and engagement

• Act as a key Cyber GRC contact across EMEA, building effective relationships across Cyber Security, Technology, Risk, Compliance, Legal and Audit.
• Influence senior and distributed stakeholders to resolve control weaknesses, evidence gaps, overdue remediation and risks outside tolerance while preserving local accountability.
• Communicate complex cyber, regulatory and control matters in clear business language, providing constructive challenge through pragmatic, delivery focused relationships.

5) Role scope and scale

• Delivers a reporting led Cyber GRC role across EMEA, while contributing to the wider first line Cyber GRC agenda within a complex, regulated and globally distributed operating model.
• Interfaces with Cyber Security, Technology, Risk, Compliance, Legal, Internal Audit, External Audit, governance secretariats and senior committees.
• Supports control design, implementation, testing, evidence and remediation across multiple cyber domains.
• Produces recurring cyber risk, KRI, control and governance reporting for management, Risk Committee, Executive and Board audiences.
• Drives implementation of relevant EU regulatory expectations, including DORA, across in-scope entities.
• Works across BAU services, regulatory and audit actions, programmes, projects, policy obligations and emerging cyber risks.

6) Knowledge, skills and experience

• Substantial experience in Cyber GRC, cyber risk, information security governance, controls or assurance, ideally within financial services or another regulated environment.
• Strong understanding of first line and second line responsibilities within an enterprise risk management framework.
• Practical experience of regulatory requirements and supervisory expectations, including DORA and EBA guidance.
• Experience operating risk and control frameworks in complex, multi entity or globally distributed organisations.
• Working knowledge of recognised frameworks and standards such as NIST, ISO 27001 and COBIT.
• Demonstrable experience leading management, Risk Committee, Executive and Board reporting, including the production of decision ready papers, dashboards, commentary and matters for escalation.
• Deep practical experience of defining and implementing mature KRI, KCI and KPI frameworks, including metric design, calculation logic, thresholds, tolerances, data lineage, quality controls, ownership and governance.
• Strong Power BI skillset, including experience designing and delivering executive dashboards, data models, measures, visualisations, drill through analysis, controlled distribution and sustainable reporting solutions.
• Experience of using tooling to automate and industrialise metrics and reporting processes, with appropriate requirements, testing, access controls, audit trails, release management and production ownership.
• Ability to interpret complex data, identify trends and anomalies, challenge data and evidence quality, and translate analysis into clear risk insight, actions and decisions.
• Experience of policy and standards lifecycle governance, exceptions, audit engagement and remediation tracking.
• Strong written and verbal communication, stakeholder management, organisation and prioritisation skills, including the ability to tailor technical cyber risk information for management, committee and Board audiences.
• Ability to influence without direct authority and maintain delivery discipline across multiple contributors and deadlines.

7) Key challenges

• Delivering consistent governance and control practices across diverse regions, entities and cyber domains.
• Maintaining high quality, accurate and timely management, Risk Committee and Board reporting under executive, regulatory and audit scrutiny.
• Influencing senior stakeholders and distributed owners to resolve evidence gaps, control weaknesses and overdue remediation.
• Keeping pace with evolving regulatory expectations while maintaining stable BAU delivery.
• Balancing competing delivery priorities with governance, assurance and control requirements.
• Implementing mature metrics and reporting through governed tooling without introducing unsupported, fragmented or poorly controlled solutions.

8) What we offer

For all the expertise and experience you bring to help us make a difference, it’s only sustainable if we support you to build your career and be your best self so we offer competitive company benefits, centred around promoting positive well-bring and work-life balance. We also believe in fostering a diverse and inclusive work environment, where all team members perspectives and contributions are valued. Initiatives in place which promote a diverse and inclusive culture and healthy work life balance include hybrid working, Sport & Social Clubs and Diversity and Inclusion networks.

The anticipated salary range for this role is €72000 – €134,000, with the final offer determined based on the candidate’s skills, experience, role scope, location, and relevant market factors. In addition to base salary, the role may be eligible for a discretionary incentive award and a competitive benefits package, including core benefits such as pension provision.

As an employee of SMBC you have access to a host of both useful and exciting benefit offerings. See below some of the benefits on offer to you:

• Hybrid and flexible working
• Competitive paid leave days
• Benefits to support your physical wellbeing, including private medical insurance and life and invalidity insurance
• Various policies to support your mental wellbeing, including a robust behavioural health network with counselling and coaching services
• Access a wide range of learning and development opportunities and career progression opportunities
• Ambitious remuneration package

So, if you like a challenge and want to continuously grow and develop in a role where you will be supported along the way by a dynamic and diverse team, apply today!!