Risk Manager IT, Information Security, Business Resilience and Third Party Risk Management

Risk Management supports Nomura to achieve its business goals by partnering with business units across the firm, providing independent advice to the Board and protecting the firm from exposure to losses as a result of credit, market, operational and other risks.

The Operational Risk Management (ORM) 2LoD function is part of the Risk Management organization and is responsible for:

• Developing operational risk frameworks and policies

• Providing independent oversight over operational risks and challenging First Line of Defense

• Monitoring risk appetite compliance

• Reporting to senior management and committees

In this role, you will be the second line of defense risk manager overseeing Nomura Information Technology and Information Security (IT & IS), Business Resilience as well as Third Party risks (TPRM). You will focus on:

• Check and Challenge the ICT risk profile of the Americas operations as well as participate in risk management programs for Nomura globally

• Provide independent risk opinions on compliance with relevant regulatory and industry expectations (NIST, FFIEC...)

• Review the risk profile across IT change management, identity and privileged access (IAM/PAM), resilience, vulnerability and patch management, data leakage prevention, etc.

• Review and challenge the 1LoD controls rollout and results.

• Produce and/or contribute to management dashboard, focusing on remediation action when needed.

• Review and Challenge the Business Continuity Management (BCM) program (BCP, testing...).

• Third-Party risk oversight

• Assess independently the adherence to industry and regulatory standards e.g. interagency guidance

• Review the proper tiering of TPs, due diligence standards, monitoring of risk acceptances...

• Independently challenge criticality and materiality designations, with particular focus on material outsourcing and intragroup service arrangements

Required Qualifications:

• 15+ years in a technical role along with exposure to / experience in technology risk management, information security, or IT audit.

• Bachelor's degree in computer science, engineering, or information systems; CISSP, CISA, CISM, CRISC, or CCSP preferred.

• Hands-on technical experience in engaging 1LoD experts on technical issues.

• Experience in proactively sustaining independent check and challenges with first line.

• Understanding of Industry standards and regulatory expectations, with experience implementing or auditing IT and IS risk compliant framework.

: Foster a culture of inclusion and psychological safety in the workplace and cultivate a "Risk Culture" (Challenge, Escalate and Respect).

• base pay offered may vary depending on multiple individualized factors, including market location, corporate and functional title and duties, job-related knowledge and advanced degrees, skills, and experience. The total compensation package for this position may also include other elements, including a sign-on bonus, restricted stock units, and discretionary awards in addition to a full range of medical, financial, and/or other benefits (including 401(k) eligibility and various paid time off benefits, such as vacation, sick time, and parental leave), dependent on the position offered. Details of participation in these benefit plans will be provided if an employee receives an offer of employment.

If hired in the U.S., employee will be in an "at-will position" and the Company reserves the right to modify base salary (as well as any other discretionary payment or compensation program) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors".

Nomura is an Equal Opportunity Employer