IT Risk Officer, Sr

Overview

Old National Bank has been serving clients and communities since 1834. With over $70 billion in total assets, we are a regional powerhouse deeply rooted in the communities we serve. As a trusted partner, we thrive on helping our clients achieve their goals and dreams, and we are committed to social responsibility and investing in our communities through volunteering and charitable giving.

We continually seek highly motivated and talented individuals as our people are critical to our success. In return, we offer competitive compensation with our salary and incentive program, in addition to medical, dental, and vision insurance. 401K, continuing education opportunities and an employee assistance program are also included in our benefit suite. Old National also offers a variety of Impact Network Groups led by team members who are passionate about driving engagement, creating awareness of diverse backgrounds and experiences, and building inclusion across the organization.

We offer a unique opportunity to join a growing, community and client-focused company that is firmly rooted in its core values.

The IT Risk Officer, Sr — Cybersecurity serves as the primary first-line risk professional for Old National Bank’s cybersecurity and information security operational domains. This senior-level role is the IT Risk Office’s subject matter expert and 1

LOD owner for five (5) Tier 1 Assessable Units encompassing Security Operations, Identity and Access Management, Data Protection, Vulnerability Management, and Threat Intelligence. The role is a direct response to the bank’s recent organizational change moving the Information Security and Cyber Security Operations function into the IT organization, creating an immediate requirement for dedicated first-line risk coverage across these domains.

This role operates at the intersection of technical security operations and enterprise risk governance. The IT Risk Officer, Sr — Cybersecurity must be equally fluent in the language of security practitioners and the language of risk committees, translating technical control performance into risk-rated assessments that drive leadership decisions. The position works daily with the CISO organization, Security Operations Center, Identity and Access Management team, and Data Protection engineering functions while simultaneously managing relationships with Internal Audit, Enterprise Risk Management, and regulatory examiners.

In addition to leading day-to-day risk oversight, this role serves as astrategic partner to the CISO, collaborating to define, evolve, and execute the enterprise cybersecurity risk strategy — ensuring the bank's security posture is proactively aligned to its risk appetite, business objectives, and evolving threat landscape.

The urgency of this hire reflects the current risk landscape. The IT Risk Officer, Sr — Cybersecurity will serve as the linchpin of the bank’s ability to demonstrate credible first-line oversight to its regulators, auditors, and board.

Salary Range

The salary range for this position is $98,400/yr - $199,000/yr plus bonus. The base salary indicated for this position reflects the compensation range applicable to all levels of the role across the United States. Actual salary offers within this range may vary based on a number of factors, including the specific responsibilities of the position, the candidate’s relevant skills and professional experience, educational qualifications, and geographic location

Key Accountabilities

• Cybersecurity Risk Strategy & CISO Partnership
  :
  Partner directly with the CISO to shape and refine the enterprise cybersecurity risk strategy, ensuring alignment between first-line risk oversight priorities and the security program roadmap. Translate risk assessment findings, threat intelligence, and regulatory expectations into strategic recommendations that inform investment decisions, capability prioritization, and program maturity targets. Provide the CISO with a risk-informed perspective on emerging initiatives (e.g., cloud migration, AI adoption, M&A integration) to enable proactive risk positioning rather than reactive…