CardWorks

CardWorks

Director, Security Risk Management

Woodbury (Long Island), USA · Director

Sponsorship not specified$151k-$168kDetected 60 days ago
CybersecurityComplianceProcurementLeadershipCommunicationProblem SolvingMentoringCISSP

About the role

  • Become an everyday champion — and build a career where your impact fuels financial progress.
  • CardWorks Financial Group is a diversified financial services platform building ethical solutions across credit, lending, and the full customer lifecycle. Through our family of companies, CardWorks Financial Group tackles the complex challenges that larger financial institutions leave behind. We're embedded throughout the credit card ecosystem as a lender,

Responsibilities

  • Become an everyday champion - and build a career where your impact fuels financial progress.
  • The Information Security Risk Management Director is responsible for leading the design, implementation, and oversight of the organization's information security risk management and vendor security assessment programs.
  • Develop and maintain consistent methodologies, templates, and workflows for risk assessments and vendor reviews.
  • Partner with Enterprise Risk Management to ensure cybersecurity risks are integrated into enterprise risk registers, prioritized appropriately, and aligned with enterprise issue management and escalation processes.
  • Collaborate with Procurement, Legal, and Third-Party Risk Management (TPRM) teams to embed security requirements into contracts, onboarding, and ongoing vendor oversight.
  • Track and manage vendor-related security issues, ensuring timely remediation, escalation, and closure consistent with SLAs and enterprise issue management processes.
  • Develop and maintain vendor risk dashboards and KRIs to provide visibility into supply-chain risk exposure and remediation progress.
  • Drive program improvements through automation, analytics, risk trend analysis, and lessons learned from incidents, audits, and assessments.

Requirements

  • Strategic and hands-on cybersecurity risk leader with a proven ability to design, implement, and mature enterprise-wide risk management programs.
  • Deep understanding of information security risk frameworks (NIST CSF, CRI Profile, PCI DSS, CIS Controls, etc.) and enterprise risk management principles, with practical experience applying them across systems, processes, and third-party vendors.
  • Demonstrated success in leading and mentoring small teams, fostering capability growth, and scaling risk management functions to meet enterprise needs.
  • Strong analytical and problem-solving skills, adept at evaluating threats, assessing process and control effectiveness, addressing gaps, and translating risks into business-relevant insights.
  • Skilled at delivering on and coordinating multiple efforts across IT, business, compliance, and ERM teams, influencing decisions, and driving risk-informed outcomes while maintaining accountability and transparency.
  • Excellent communication and interpersonal skills (via email, chat, in-person, and virtual) to engage effectively with technical teams, executives, and non-technical stakeholders.
  • High level of attention to detail and organization, ensuring accurate, timely, and complete documentation and reporting.
  • Recognized as a trusted advisor and credible authority, capable of balancing strategic oversight with hands-on execution in a dynamic and evolving environment.
  • Self-motivated and collaborative, with a strong commitment to continuous improvement, accountability, operational excellence, and promoting a culture of proactive security risk management across the organization.

Nice to have

  • Provide strategic and hands-on leadership for a small team and/or third-party resources responsible for executing assessments, managing risk registers, and maintaining program processes.
  • Risk Assessment and Governance
  • Mature risk scoring methodologies to prioritize risks based on likelihood and business impact.
  • Identify opportunities to streamline assessment workflows, automate evidence collection, and enhance tool integration across GRC, IT, and security systems.
  • Define, track, and report cybersecurity risk metrics, dashboards, and assessment outcomes for senior leadership.
  • Promote a culture of transparency, accountability, and proactive cyber risk management throughout the organization.
  • Demonstrated experience in assessing, mitigating, and tracking security risks across systems, infrastructure, and third-party vendors, with proven success in driving remediation and program maturity.
  • Familiarity with GRC or security compliance platforms (e.g. Archer, ServiceNow, Auditboard) and reporting mechanisms for documenting and tracking risk, remediation, and control testing results.

Skills

  • Ensure data quality, consistency, evidence integrity, and traceability across GRC platforms and supporting tools

Compensation

  • The salary range for this position, if located in NY Metro/NY State is $151,165 to $167,961.

Benefits

  • Competitive Pay, including a Bonus Target or Variable Pay Incentive Program
  • Benefits Package -Medical, Dental, and Vision (plus much more)
  • Short- & Long-Term Disability
  • Wellness Programs
  • Paid Vacation, Sick Days and bank Holidays
  • Through our family of companies, CardWorks Financial Group tackles the complex challenges that larger financial institutions leave behind.

Company info

  • Merrick Bank: The bank that builds
  • CardWorks Servicing: One partner, total performance
  • Carson Smithfield: Resolution with respect
  • With nearly 40 years of operating history, our track record is solid: disciplined in downturns and built to accelerate in recovery. The CardWorks Financial Group companies take precise approach in complex markets, as a top three non-prime focused general purpose card issuer and a top fifteen U.S. merchant acquirer.
  • CardWorks Financial Group is a diversified financial services platform building ethical solutions across credit, lending, and the full customer lifecycle.
  • We're embedded throughout the credit card ecosystem as a lender, servicer, and merchant acquirer.
  • With nearly 40 years of operating history, our track record is solid: disciplined in downturns and built to accelerate in recovery.
  • The CardWorks Financial Group companies take precise approach in complex markets, as a top three non-prime focused general purpose card issuer and a top fifteen U.S. merchant acquirer.
  • Our team tackles the industry's most complex credit and payment challenges.
  • And we believe that excellent work starts with a team that feels supported, respected, and empowered to grow.
  • CardWorks Servicing, LLC provides end-to end operational servicing functions for credit cards, secured cards, and installment loans.
  • We service consumer and small business loans across the credit spectrum and offers backup servicing and due diligence services to capital providers and trustees.
  • Founded in 1997, Merrick Bank is an FDIC®-insured financial institution headquartered in South Jordan, Utah, with over $10 billion in assets.

Visa & Work Authorization

  • y/expression (including pregnancy, childbirth, transgender status, or sexual orientation), religion or creed, ancestry, citizenship, national origin, disability, military or veteran status, marital status, genetic inform
Apply directly at CardWorks →Create a free account for alerts like thisView CardWorks immigration profile

This listing is sourced directly from CardWorks's careers page and normalized into a canonical job model.