Cybersecurity Risk Governance Principal

We are looking for a talented Cybersecurity Risk Governance Principal to join our team specializing in Systems/Information Technology for our Corporate organization. This is a remote role.

In this role, you will make an impact in the following ways:

- Lead the identification, assessment, and mitigation of cybersecurity risks by applying Cummins cybersecurity policies, risk management frameworks, and data privacy principles to protect critical business assets.

- Develop and execute cybersecurity strategies that proactively address emerging threats, reduce organizational risk, and strengthen the overall security posture of the business.

- Drive the application of industry frameworks and standards, including NIST, ISO, ITIL, and COBIT, ensuring cybersecurity controls and processes align with organizational objectives and compliance requirements.

- Serve as a trusted advisor to business and technology stakeholders, providing guidance on new and evolving technology solutions while balancing innovation with security and risk management.

- Influence and advocate for cybersecurity policy enhancements that improve governance, support evolving business needs, and reinforce enterprise-wide security practices.

- Lead financial planning activities, including Annual Operating Plan (AOP) development, budget management, forecasting, and resource allocation to ensure effective investment in cybersecurity initiatives.

- Build, develop, and lead high-performing teams through strategic recruiting, performance management, coaching, succession planning, and global team collaboration.

- Foster strong cross-functional relationships and a culture of accountability, ensuring adherence to Cyber, IT, and Corporate policies while delivering measurable business value through effective Business Relationship Management practices.

This role leads enterprise cybersecurity risk governance, connecting security functions and business stakeholders to prioritize and reduce strategic cyber risks in line with business objectives and risk appetite.

- Risk governance leadership: The manager administers the enterprise cyber risk governance process, ensures consistent risk identification and reporting, guides risk acceptance, and recommends treatment strategies and investment priorities based on risk reduction value and business impact.
- Cross-functional risk orchestration: The role integrates threat intelligence and emerging threat trends into treatment priorities, coordinates stakeholders across cybersecurity, legal, privacy, compliance, and business units, resolves roadblocks, and ensures treatment plans have owners, funding paths, and timelines. It also presents risk posture and business impacts to senior leadership and supports enterprise risk management committees.
- Qualifications and environment: Candidates need a bachelor’s degree in cybersecurity, information technology, or a related field; 5 to 7 years of cybersecurity experience, including 3 to 5 years in cybersecurity risk management or enterprise risk management; familiarity with NIST RMF, FAIR, or quantitative risk methods; and knowledge of threat intelligence, security operations, identity and access management, cloud security, privacy, legal risk, and regulatory requirements. Strong communication, analytical, organizational, and collaboration skills are required, while CISSP, CISM, or equivalent certification is preferred.

The Cybersecurity Risk Governance Manager will serve as the central orchestrator between Governance, BRI, Cyber Threat Intelligence, Cyber Operations, and Business stakeholders to ensure enterprise strategic cyber risks are understood, prioritized, and reduced through coordinated treatment strategies aligned with business objectives and risk appetite.

- Enterprise Risk Governance:

Leads the operation and administration of the enterprise cyber risk governance process under the direction of Cybersecurity Governance leadership.
- Ensure risks are consistently identified, assessed, categorized, and reported.
- Facilitate risk acceptance governance and provide recommendations to decision-makers.

- Strategic Risk Treatment Leadership:

Recommend enterprise-wide treatment strategies targeting root causes rather than individual issues.
- Recommend risk reduction investment priorities based on risk reduction value and business impact.

- Threat and Intelligence Integration:

Partner closely with BRI and Cyber Threat Intelligence to address emerging threats.
- Translate threat trends, intelligence reports, and emerging risk drivers into strategic risk treatment priorities.
- Assess how evolving threat activity impacts enterprise risk exposure.

- Cross-Functional Orchestration:

Convene stakeholders from Cyber Ops, IAM, Infrastructure, Application Security, Compliance, Privacy, Legal, and Business Units.
- Resolve roadblocks impacting risk reduction initiatives.
- Ensure strategic treatment plans have accountable owners, funding paths, and timelines.

- Executive Risk Communication & Reporting: Present risk posture and treatment progress to senior leadership.
- Translate technical cyber risks into business impacts (Financial, Operational, Regulatory, Reputational)
- Support ERM & governance committees as Cybersecurity Risk Expert.

- Risk Exception & Acceptance Governance: Define and govern risk acceptance criteria, approval authorities, oversight requirements and exception management processes.
- Establish and oversee the governance framework for risk acceptance and exceptions.