Principal First Line Risk Specialist - Cybersecurity and AI Initiatives
M&T Bank · Buffalo · $148,300–$247,100 (stated in the posting)
This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week
Overview:
Leads risk analysis and governance activities for emerging Cybersecurity and Artificial Intelligence (AI) initiatives, influencing the design of risk frameworks, controls, and standards that support evolving technologies. Provides expert guidance to senior leadership, engineering, and architecture teams to proactively identify, assess, and mitigate technology risks while ensuring alignment with regulatory expectations and organizational objectives.
Primary Responsibilities:
- Develop and implement risk frameworks, controls, and standards supporting Cybersecurity and AI engineering capabilities, ensuring comprehensive coverage of emerging technologies.
- Act as a first line of risk advisor to engineering, architecture, and security teams, proactively identifying risks, control gaps, and opportunities to strengthen governance.
- Lead the assessment of emerging technology trends, regulatory guidance, and industry developments to ensure organizational readiness and compliance.
- Design, enhance, and implement risk management processes, procedures, and standards that support new and evolving Cybersecurity and AI initiatives.
- Partner directly with the Chief Information Security Officer (CISO), senior technology leaders, engineers, and architects to evaluate strategic initiatives and provide risk-informed recommendations.
- Drive the identification, development, and implementation of new controls to address emerging risks and strengthen the organization's risk posture.
- Lead and support audit activities, regulatory examinations, and risk assessments, ensuring timely remediation of findings and sustainable control improvements.
- Collaborate across Technology, Cybersecurity, AI, Enterprise Risk, Internal Audit, and Regulatory Affairs functions to align practices with business objectives and regulatory expectations.
- Monitor and assess evolving threat landscapes and emerging technology risks, integrating advanced risk management methodologies to address changing business and regulatory requirements.
- Prepare and present complex risk assessments, control evaluations, and recommendations to senior leadership and executive stakeholders.
- Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite. Identify risk-related issues requiring escalation to management.
- Promote an environment that supports belonging and reflects the Company's values and culture.
- Maintain internal control standards, including timely implementation of internal and external audit recommendations together with any issues raised by regulators as applicable.
- Complete other related duties as assigned.
Scope of Responsibilities:
- This position works closely with the CISO, senior engineering and architecture leaders, Cybersecurity leadership, Technology and Cybersecurity Risk leadership, Enterprise Risk, Internal Audit, Regulatory Affairs, and other senior stakeholders across the organization.
- Serves as a key risk partner for Cybersecurity and AI engineering initiatives, applying significant judgment and expertise to identify emerging risks, evaluate control effectiveness, and recommend strategic solutions.
- Exercises substantial independence in determining approaches to risk management, control design, and governance activities for emerging technologies, while collaborating with executive stakeholders on critical decisions.
- May represent the organization during regulatory examinations, audits, and governance reviews related to Cybersecurity, AI, and emerging technology risk management.
- Functions as a subject matter expert on Cybersecurity and AI risk, advising leadership on industry trends, regulatory developments, control design, and risk mitigation strategies.
Supervisory/Managerial Responsibilities:
No supervisory responsibilities.
Education and Experience Required:
- Bachelor's degree and a minimum of 9 years’ relevant work experience, or in lieu of a degree, a combined minimum of 13 years’ higher education and/or work experience
- Demonstrated expert knowledge of Technology and Cybersecurity risk principles
- Minimum of 8 years' relevant work experience in and/or with the specific risk area and/or business unit
Education and Experience Preferred:
- Master's degree in Information Technology, Computer Science, Cybersecurity, Law, Business Administration, or related field
- Applicable certification align to function or domain such as Certified in Risk and Information Systems Control (CRISC®), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP)
- Experience supporting Cybersecurity, AI, and emerging technology initiatives, including risk assessments, governance, and control design.
- Proven ability to identify control gaps, develop new controls, and implement risk mitigation strategies within a first line of risk environment.
- Experience developing processes, procedures, standards, and risk frameworks that support cybersecurity programs, AI adoption, and evolving technology capabilities.
- Strong understanding of emerging technology trends, cybersecurity risks, and regulatory guidance related to AI and information security.
- Experience partnering directly with senior leaders, engineering and architecture teams, and executive stakeholders, including the CISO, to provide risk-informed recommendations and influence strategic decision-making.
- Experience supporting audits, regulatory examinations, and control reviews, with a demonstrated ability to proactively identify risks, drive remediation efforts, and communicate effectively with both technical and business audiences.