Principal First Line Risk Specialist - Cybersecurity and AI Initiatives

Location: Buffalo, New York, United States; four days onsite at Seneca One Buffalo and one day per week working from home

Salary: $148,300–$247,100 annual USD

Company

M&T Bank provides banking and financial services and operates technology, cybersecurity, and risk management functions.

What you will do

• Develop and implement risk frameworks, controls, standards, and governance processes for cybersecurity, artificial intelligence, and emerging technology initiatives.
• Advise engineering, architecture, security, and senior technology leaders as a first-line risk partner.
• Assess emerging technology trends, threat landscapes, regulatory guidance, and industry developments.
• Identify control gaps, design new controls, and drive sustainable risk mitigation and remediation.
• Support audits, regulatory examinations, risk assessments, and governance reviews.
• Prepare and present complex risk assessments, control evaluations, and recommendations to executive stakeholders, including the CISO.

Requirements

• Bachelor's degree and at least 9 years of relevant experience, or a combined 13 years of higher education and/or work experience in lieu of a degree.
• At least 8 years of relevant experience in the specific risk area or business unit.
• Expert knowledge of technology and cybersecurity risk principles.
• Experience with risk assessments, governance, control design, regulatory guidance, audits, and remediation.
• Ability to partner with senior leaders, engineers, architects, executive stakeholders, and regulatory functions.
• Ability to work onsite in Buffalo four days per week, with one work-from-home day.

Nice to have

• Master's degree in information technology, computer science, cybersecurity, law, business administration, or a related field.
• CRISC, CISA, CISM, CISSP, or a related certification.
• Experience supporting AI adoption, cybersecurity programs, and emerging technology initiatives.

Culture & Benefits

• Work with the CISO, cybersecurity, technology risk, enterprise risk, internal audit, regulatory affairs, engineering, and architecture functions.
• Opportunity to influence risk management and governance for evolving technologies.
• Compensation is market-informed and based on the successful candidate's knowledge, skills, and experience.
• Work arrangement combines regular onsite collaboration with one remote workday per week.