Assessments & Exercises - Third-Party Cybersecurity Assessment Architect

Contribute to leading-edge security and resilience efforts, advancing protective strategies and propelling continuous improvement.

As an Assessments & Exercises Vice President in Cybersecurity and Technology Controls organization, you will contribute significantly to enhancing the firm's cybersecurity or resiliency posture by using industry-standard assessment methodologies and techniques to proactively identify risks and vulnerabilities in people, processes, and technology. Design and deploy risk-driven tests and simulations (or manage a highly-skilled team that does) and inform analysis to clearly outline root-causes. In this role, evaluate preventative controls, incident response processes, and detection capabilities, and advise cross-functional teams on security strategy and risk management.

In this role you will help to assess the health and security of JPMC’s Third-Party suppliers, identifying risks and gaps in their control maturity. You will evaluate suppliers’ infrastructure, application and control environments providing transparency into the cyber resilience, recoverability and operational/data risks associated with key relationships. This role involves a high-degree of stakeholder engagement, suiting an individual with excellent leadership skills who is able to navigate complex organizations and build relationships across Business and Technology teams. As part of our global team of technologists and innovators, your work will have a critical impact on our company, as well as our clients and our business partners around the world. Successful candidates will help to shape the future of Third-Party cybersecurity assessments for JPMC.

Job responsibilities

• Design and execute testing and simulations – such as penetration tests, technical controls assessments, cyber exercises, or resiliency simulations, and contribute to the development and refinement of assessment methodologies, tools, and frameworks to ensure alignment with the firm’s strategy and compliance with regulatory requirements


• Evaluate supplier compliance with cybersecurity standards and exposure to industry risks, provide insights into corrective actions and mitigations that will help to strengthen cyber resilience. 


• Assess supplier controls for effectiveness and impact on operational risk, as well as opportunities to automate control evaluation


• Collaborate closely with cross-functional teams to conduct detailed evaluations and develop comprehensive assessment reports of security controls and practices – including detailed findings, risk assessments, and remediation recommendations – making data-driven decisions that utilize continuous improvement.


• Provide guidance and advice to Business, Technology and Third-Party supplier groups on cybersecurity best practices 


• Support development of supplier risk metrics to articulate the efficacy of suppliers security arrangements


• Participate in thematic analysis, identifying trends/common issues in supplier security posture


• Partner with Product Security, Tech Risk & Controls and Risk Pillar leads to raise awareness and drive improvements in Third-Party control implementations


• Utilize threat intelligence and security research to stay informed about emerging threats, vulnerabilities, industry best practices, and regulations. Apply this knowledge to enhance the firm's assessment strategy and risk management. Engage with peers and industry groups that share threat intelligence analytics

Required qualifications, capabilities, and skills

• 5+ years of experience in cybersecurity or resiliency, with demonstrated exceptional organizational skills to plan, design, and coordinate the development of control delivery, security testing, assessments, or simulation exercises


• Deep understanding of key cybersecurity principles and control implementations that mitigate common threat actor techniques (Email, Network, Endpoint, Resiliency & Recovery (incl. response plans), Monitoring, End User Awareness, Vulnerability Management, and/or Identity and Access Management)


• Process engineering and re-engineering skills.


• Ability to clearly translate and communicate cyber risk via written, verbal and presentation formats to a variety of stakeholders in Cyber, Technology and the Business 


• Knowledge of US financial services sector cybersecurity or resiliency organization practices, operations risk management processes, principles, regulations, threats, risks, and incident response methodologies


• Ability to identify systemic security or resiliency issues as they relate to threats, vulnerabilities, or risks, with a focus on recommendations for enhancements or remediation, and proficiency in multiple security assessment methodologies (e.g., Open Worldwide Application Security Project (OWASP) Top Ten, National Institute of Standards and Technology (NIST) Cybersecurity Framework), offensive testing tools, or resiliency testing equivalents


• Highly Analytical, tenacious and inquisitive mindset


• Self-starter with drive to deliver results and continuous improvement mindset


• Excellent communication, collaboration, and report writing skills, with the ability to influence and engage stakeholders across various functions and levels

Preferred qualifications, capabilities, and skills

• Hold relevant industry certifications – such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Offensive Security Certified Professional (OSCP)– showcasing advanced expertise in cybersecurity and offensive testing methodologies or resiliency


• Knowledge/experience in modern programming language


• Background in Product Security, Incident Response, Technology/Cyber Audit