Information Security Governance & Risk Officer

Bank Newport celebrates being a community bank since 1819. Offering new and exciting career opportunities, Bank Newport is committed to providing our employees the resource and guidance to develop careers that are challenging and rewarding.

So if you're looking for a great professional opportunity, know that Bank Newport will empower and invest in you.

The Information Security Governance & Risk Officer leads the Bank's information security governance, risk, compliance, resiliency, awareness, and assurance programs. Reporting to the Chief Information Security Officer and working alongside the Information Security Operations Officer, the role provides independent oversight of vendor and technology risk, risk assessments, policy governance, audits and examinations, issue remediation, business continuity and disaster recovery, security awareness and phishing testing, governance metrics, and related regulatory obligations.

The role translates regulatory, policy, and risk requirements into practical oversight, remediation, and reporting. The CISO retains accountability for the Information Security Program, strategy, risk acceptance, major incident command, and executive and Board reporting. Technology, business, vendor, and system owners remain accountable for implementing and operating controls.

• Establish consistent governance methods, schedules, documentation, metrics, evidence standards, and issue-management practices across assigned programs.
• Work with the Legal and Compliance teams to translate applicable laws, guidance, Bank policies, risk appetite, and security standards into program requirements, control expectations, reporting, and escalation criteria.
• Provide independent oversight by assessing risks and controls, confirming ownership and timely remediation, validating outcomes, and escalating residual risk. Information Security defines requirements and provides oversight;
  Technology, business, vendor, and system owners implement and operate controls.

• Lead risk methodologies, inventories, scoring, assessment schedules, and reporting for information security, technology, customer information, third parties, cloud services, projects, business changes, and emerging risks.
• Coordinate stakeholder assessments of threats, vulnerabilities, control effectiveness, business impact, data sensitivity, criticality, dependencies, third-party exposure, compensating controls, and residual risk; recommend treatment.
• Lead Information Security due diligence and ongoing third-party oversight, including onboarding, risk tiering, periodic and material-change reviews, contractual and resiliency requirements, issue follow-up, and offboarding.
• Maintain an integrated register of risks, findings, exceptions, compensating controls, owners, due dates, evidence, and status; coordinate remediation and elevate material, repeat, accepted, or overdue exposure.
• Validate closure through evidence or testing, identify themes and priorities, and maintain audit-ready risk records and recommendations for management, committees, examinations, and independent review.

• Define Information Security scope, priorities, and engagement for audits, regulatory examinations, independent assessments, and control testing assigned by the CISO.
• Coordinate requests, interviews, evidence, responses, action plans, status tracking, and closure; maintain audit-ready records of ownership, approvals, exceptions, testing, remediation, and reporting.
• Map regulatory and framework requirements to policies, risks, controls, owners, evidence, and testing; identify gaps and recommend improvements.
• Monitor relevant laws, guidance, examination expectations, and industry practices and assess their impact on the Information Security Program.

• Coordinate the lifecycle of assigned information security policies, standards, methodologies, procedures, and governance documents, including drafting, review, approval, publication, acknowledgment, exceptions, and periodic review. The CISO remains the designated policy owner where applicable.
• Keep governance documents aligned with the Bank's risk profile, operating model, regulatory obligations, supporting procedures, and control practices, with clear ownership, review dates, approvals, revision history, mappings, and exception records.
• Partner with the CISO, Legal,…