Full-time Assistant General Counsel, Citizens

Citizens is seeking an experienced, solutions-oriented Cybersecurity Attorney to

join the Legal Cyber and Privacy team. In this role, you will serve as a key

legal advisor on cybersecurity, data security, incident response, technology

risk, and related regulatory matters.

You will partner closely with colleagues across Cyber Defense, Technology,

Information Security, Risk, Compliance, Privacy, Communications, and the

business to provide practical, business-focused legal advice, identify and

mitigate legal and regulatory risk, and support Citizens’ cybersecurity and

operational resilience objectives.

The ideal candidate brings significant cybersecurity and technology legal

experience, strong judgment and technical fluency, and the ability to provide

clear, actionable counsel to senior leaders during complex and time-sensitive

matters.

02Primary responsibilities include

• Provide strategic legal counsel on cybersecurity, data security, incident
• response, technology risk, and related regulatory matters.
• Serve as a primary legal advisor during cyber and data-security incidents,
• partnering with Cyber Defense, Technology, Information Security,
• Communications, Compliance, Risk, Privacy, and senior leadership.
• Advise on incident escalation, legal and regulatory materiality assessments,
• regulatory notifications, disclosure obligations, regulatory engagement, and
• related internal and external communications.
• Monitor and interpret evolving cybersecurity laws, regulations, regulatory
• guidance, and supervisory expectations and advise stakeholders on their
• impact to Citizens’ operations, technology environment, and risk-management
• practices.
• Support enterprise crisis-management activities, including escalation,
• response coordination, internal governance, regulatory engagement, and
• communications during significant events.
• Draft, review, and maintain cybersecurity and incident-response policies,
• standards, procedures, governance documents, and playbooks.
• Provide legal guidance for cyber tabletop exercises, readiness assessments,
• and cross-functional simulations designed to strengthen incident-response
• capabilities and operational resilience.
• Serve as legal advisor to the Bank’s Red Team, providing practical,
• risk-based guidance regarding penetration testing, adversarial simulations,
• threat-emulation activities, and other cybersecurity testing.
• Advise on cybersecurity and data-security requirements applicable to
• third-party service providers and technology integrations, including
• contractual protections, due diligence, incident-notification requirements,
• vendor oversight, and regulatory expectations.
• Serve as legal advisor to the Bank’s Open Source Office, providing guidance
• regarding the use, development, modification, licensing, and distribution of
• open-source software, including open-source software used or provided by
• third-party vendors.
• Draft, review, and negotiate technology, cybersecurity, data-security, cloud,
• software, and related commercial agreements.
• Partner with business and control functions to identify legal risks and
• develop practical, business-aligned solutions that support Citizens’
• strategic and operational objectives.
• Qualifications, Education, Certifications and/or Other Professional Credentials

03Required Qualifications

• Juris Doctor degree from an accredited law school.
• Active license to practice law and membership in good standing in at least
• one U.S. jurisdiction.
• At least six years of relevant legal experience, including significant
• experience in cybersecurity, data security, privacy, technology law, cyber
• incident response, or a related area.
• Experience advising on cyber incident response, including legal and
• regulatory materiality assessments, notification and disclosure obligations,
• regulatory engagement, and supervisory expectations.
• Strong knowledge of cybersecurity laws, regulations, regulatory guidance, and
• recognized cybersecurity and data-protection frameworks.
• Experience drafting and maintaining cybersecurity policies, incident-response
• procedures, standards, governance documents, or playbooks.
• Strong contract drafting and negotiation skills, particularly involving
• technology services, cybersecurity, data protection, software, cloud
• services, and third-party risk.
• Demonstrated ability to assess complex legal and regulatory risks and provide
• practical, business-focused advice.
• Excellent written, verbal, and analytical skills, with the ability to
• communicate complex legal and technical matters clearly to senior and
• executive leadership.
• Ability to manage multiple priorities and operate effectively in a fast-paced
• environment, including during significant cybersecurity incidents and other
• time-sensitive matters.

04Preferred Qualifications

• Experience advising a financial institution or other highly regulated
• organization on cybersecurity, technology, data-security, or
• incident-response matters.
• Familiarity with cybersecurity technologies and control environments,
• including logging and monitoring, endpoint security, identity and access
• management, cloud environments, vulnerability management, threat detection,
• and security-testing platforms.
• Experience supporting cybersecurity regulatory examinations, supervisory
• inquiries, internal investigations, or remediation programs.
• Experience supporting crisis-management activities and internal and external
• communications relating to cybersecurity or data-security events.
• Experience advising on open-source software licensing, governance,
• development, and distribution.
• Experience working with cybersecurity testing teams, Red Teams, penetration
• testers, or similar technical functions.

05Hours & Work Schedule

• Hours per Week: 40
• Work Schedule: Full-time

06Pay Transparency

• The salary range for this position is $176,000 - $227,000 per year, plus an

opportunity to earn an annual discretionary bonus. Actual pay is based on

various factors including but not limited to the budget, work location, and

relevant skills and experience.

We offer competitive pay, comprehensive medical, dental and vision coverage,

retirement benefits, maternity/paternity leave, flexible work arrangements,

education reimbursement, wellness programs and more. Note, Citizens’ paid time

off policy exceeds the mandatory, paid sick or paid time-away policy of every

local and state jurisdiction in the United States. For an overview of our

benefits, visit https://jobs.citizensbank.com/benefits.

07Equal Employment Opportunity

• Citizens, its parent, subsidiaries, and related companies (Citizens) provide
• equal employment and advancement opportunities to all colleagues and applicants
• for employment without regard to age, ancestry, color, citizenship, physical or
• mental disability, perceived disability or history or record of a disability,
• ethnicity, gender, gender identity or expression, genetic information, genetic
• characteristic, marital or domestic partner status, victim of domestic violence,
• family status/parenthood, medical condition, military or veteran status,
• national origin, pregnancy/childbirth/lactation, colleague’s or a dependent’s
• reproductive health decision making, race, religion, sex, sexual orientation, or

any other category protected by federal, state and/or local laws. At Citizens,

we are committed to fostering an inclusive culture that enables all colleagues

to bring their best selves to work every day and everyone is expected to be

treated with respect and professionalism. Employment decisions are based solely

on merit, qualifications, performance and capability.

08Equal Employment and Opportunity Employer

Job Applicant Data Privacy Policy

09[https://jobs.citizensbank.com/Job-Applicant-Privacy-Policy]

Background Check

Any offer of employment is conditioned upon the candidate successfully passing a

background check, which may include initial credit, motor vehicle record, public

record, prior employment verification, and criminal background checks. Results

of the background check are individually reviewed based upon legal requirements

imposed by our regulators and with consideration of the nature and gravity of

the background history and the job offered. Any offer of employment will include

further information.