Director Cybersecurity Risk Management

Responsibilities:

• Risk Aggregation and Quantification: 
• Maintain and evolve the enterprise cyber risk model that aggregates risks across domains (e.g., IAM, TPRM, Vulnerability Mgmt, SecOps) and quantifies exposure using defensible methods (e.g., FAIR/SAFE) to support prioritization and investment decisions. 
• Maintain risk taxonomy, impact/likelihood scales, and normalization rules to ensure consistent roll ups at application, business unit, domain, and enterprise levels. 
• Partner with Finance and Business stakeholders to translate cyber scenarios into loss ranges and forecasted exposure; produce quarterly quantified risk posture and top risk heatmaps 
• Cyber Threat Intelligence (CTI) Triage:
•  Operate a threat intake and triage workflow that maps intel to cyber risks 
• Maintain an intel-to-risk pipeline: convert priority threats into scenario analyses, KRIs, and mitigation initiatives with accountable owners and time-bound outcomes. 
• Coordinate with Incident Response and Vulnerability Management to ensure timely validation, enrichment, and closure of threat-driven findings. 
• Human Risk Oversight: 
• Lead Human Risk governance forums and steering committee activities to drive accountability, decision-making, and cross functional alignment. Present human risk posture, trends, emerging threats, and risk reduction strategies to executive leadership and governance committees.
• Oversee governance processes for human risk exceptions, risk acceptance decisions, corrective actions, and remediation initiatives. 
• Ensure clear ownership, accountability, and measurable outcomes for human risk treatment activities across the enterprise. 
• Establish and monitor human risk KPIs. KRIs, and escalation thresholds to support data-driven risk management and executive reporting. 
• Drive targeted risk reduction efforts by identifying high-risk populations, roles and behaviors, and partnering with stakeholders to implement corrective actions. 
• Steering Committee Coordination: 
• Run the Cyber Risk & Steering Committee for cadence: agenda, decision memos, and action tracking. 
• Present the quantified risk posture, trend lines, and treatment plans; drive decisions on priorities, funding, risk acceptance, and policy exceptions.
• Maintain a transparent decision log and ensure alignment with enterprise risk management and audit/compliance obligations. 
•  KRI Thresholds & Playbooks: 
• Define a risk metrics framework: KRIs/KPIs tied to key scenarios (e.g., ransomware, unauthorized access, critical thirdparty risk. 
• Set thresholds and red/amber/green bands with clear playbooks (trigger conditions, owners, actions, timelines, and communications). 
• Automate metric collection and visualization; monitor drift, investigate signal quality, and continuously refine thresholds to reduce noise and increase leading indicators.
• Performs duties in accordance with Penn Medicine and entity values, policies, and procedures 
• Other duties as assigned to support the unit, department, entity, and health system organization

Credentials:

• Information Security Professional Certification – CISSP, CGRC, CISM, CISA, etc. is preferred. 

Education or Equivalent Experience:

• Bachelor's degree is required. 
• 10+ years of IT and cybersecurity experience, with a minimum of 3 years within Sr. Leadership experience is required. 
• 3+ years of Cybersecurity Governance, Risk, and Compliance is required.