MD Cyber Governance & Regulatory Relations

The Managing Director, Cyber Governance & Regulatory Relations is responsible for leading the cybersecurity governance, executive engagement and reporting, policy and standards, regulatory engagement, examination readiness, and regulatory response functions. The role establishes the governance structures, documentation standards, and regulatory engagement capabilities that enable effective oversight of cybersecurity risks across the enterprise.

This role serves as the primary cybersecurity liaison for regulators and oversees the firm's cybersecurity regulatory management lifecycle, including examination preparation, regulatory intake and facilitation, questionnaire management, regulatory compliance responses, commitment tracking, and repository management. The role is responsible for cyber executive reporting to governance committees and the board.

Core Responsibilities

Cyber Governance

• Lead the cybersecurity governance framework and governance operating model.
• Oversee governance forums, management committees, escalation processes, accountability structures, and executive reporting routines.
• Drive governance maturity across cybersecurity functions and legal entities.
• Establish governance metrics and effectiveness measures.
• Ensure governance activities support cyber risk management objectives and Board expectations.

Policies & Standards

• Own the cybersecurity policy and standards framework.
• Oversee policy development, maintenance, approval, communication, implementation, and review.
• Govern exceptions, waivers, and compensating control processes in collaboration with First Line Risk and Controls.
• Ensure ongoing alignment with regulatory requirements, industry frameworks, and enterprise policies.
• Monitor policy effectiveness.

Regulatory Affairs & Examination Management

• Lead all cybersecurity examinations, supervisory reviews, and regulatory interactions.
• Develop and maintain cybersecurity examination readiness programs.
• Coordinate examination preparedness activities, evidence production, stakeholder training, and management reviews.
• Manage regulatory intake, engagement governance, and examination coordination.
• Monitor emerging regulatory expectations and supervisory trends.
• Advise executive leadership regarding regulatory developments and potential impacts.

Regulatory Questionnaires & Compliance Responses

• Own the end-to-end process for cybersecurity regulatory questionnaires, information requests, due diligence reviews, regulatory surveys, and compliance assessments.
• Establish governance processes, response standards, review requirements, and approval workflows.
• Coordinate response development and ensure consistency across Cyber Risk, TPCRM, Security Engineering, Security Operations, Legal, Compliance, Enterprise Risk Management, Internal Audit, and business stakeholders.
• Ensure responses are accurate, evidence-based, risk-informed, and aligned with approved enterprise positions.
• Maintain executive oversight and quality review of all submitted responses.
• Track supplemental requests, commitments, actions, and remediation activities arising from regulatory inquiries.
• Ensure traceability between responses, supporting evidence, policies, standards, controls, risks, and issue records.

Regulatory Repository & Knowledge Management

• Own the cybersecurity regulatory repository.
• Maintain examination artifacts, evidence inventories, response libraries, commitments, regulatory correspondence, and historical submissions.
• Establish standards for response reuse, documentation quality, evidence traceability, and version control.
• Ensure sustainable examination and regulatory readiness across the organization.

Executive Reporting & Board Support

• Lead preparation of executive and Board reporting related to cyber risk, governance effectiveness, examination readiness and remediation status, regulatory commitments, and emerging regulatory developments.
• Communicate strategic governance and regulatory insights to executive management.
• Represent cybersecurity governance and regulatory matters in senior leadership, and regulatory forums.

Qualifications

• 15+ years of leadership experience in cybersecurity governance, regulatory affairs, compliance, operational risk, audit, enterprise risk management, or technology governance.
• Significant experience leading regulatory examinations, supervisory engagements, and regulatory response programs within a highly regulated organization.
• Demonstrated expertise in cybersecurity governance frameworks, policy management, regulatory compliance, and Board governance.
• Strong understanding of global financial services regulatory expectations and risk management practices.
• Experience developing enterprise-wide governance and compliance programs.
• Proven ability to influence executive leadership and regulators.
• Exceptional written, verbal, and presentation skills.
• Bachelor's degree required; advanced degree preferred.

Preferred Skills

• Master's degree in Cybersecurity, Business Administration, Risk Management, Law, Public Policy, or related discipline.
• CISSP, CISM, CRISC, CISA, CGEIT, or comparable professional certifications.
• Prior experience serving as a primary regulator-facing executive.
• Experience leading global policy and standards programs.
• Experience supporting Governance Committees.
• Experience managing regulatory commitments across multiple jurisdictions.
• Knowledge of industry cyber security frameworks such as: NIST Cybersecurity Framework, ISO 27001, and other financial sector regulatory expectations including those of the Federal Reserve, FFIEC, FCA, MAS, APRA, and ECB
• Experience implementing governance, reporting, and regulatory workflow technologies.

Salary Range:

The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.

For a full overview, visit https://hrportal.ehr.com/statestreet/Home.

About State Street

Across the globe, institutional investors rely on us to help them manage risk, respond to challenges, and drive performance and profitability. We keep our clients at the heart of everything we do, and smart, engaged employees are essential to our continued success.

We are committed to fostering an environment where every employee feels valued and empowered to reach their full potential. As an essential partner in our shared success, you’ll benefit from inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks that keep you connected to what matters most. Join us in shaping the future.

As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.

Discover more information on jobs at StateStreet.com/careers

Read our CEO Statement

Job Application Disclosure:

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.