CISO: Strategy, Programs & GRC Leader

Bocusa; New York (NY); On-site; USD 65,000 - 150,000; Full time

Job summary

Bank of China in New York, NY seeks an information security leader to drive Strategy, Programs, Governance, Risk, and Compliance for the US operations. You will coordinate security strategy, manage CISO projects, and oversee policy development, training, and metrics to ensure strong governance and regulatory alignment.

You will conduct risk assessments, manage privacy programs, and coordinate audits while guiding cross-functional teams to implement robust controls aligned with NIST/FFIEC

Qualifications

• Bachelor’s degree in a relevant field.
• Minimum 5 years of work experience in Risk Management, Audit, IT/IS Operations, or related functions.
• Minimum 3 years of experience developing and executing IT/IS Risk programs, projects, and policies.
• Minimum 1 year of experience with US Banking Regulations and IT/IS Risk Frameworks.
• Strong program, frameworks, project management, development, and maintenance skills.
• Strong writing skills for governing documents (policies/standards).
• Excellent verbal and interpersonal skills across stakeholders including senior management.
• Familiarity with IT/IS Risk Management regulations, standards, and frameworks (NIST, ISO27002, FFIEC).

Responsibilities

• Coordinate Information Security strategy aligned with the branch strategy.
• Maintain initiative tracking and KRIs to monitor progress.
• Conduct quarterly strategy reviews with CISO team and adjust as needed.
• Provide end-to-end project management for CISO-led projects.
• Manage Information Security Program, Data Privacy Program, and Training & Culture Program, including phishing campaigns and tabletop exercises.
• Establish and maintain Information Security policies; define roles and responsibilities.
• Refresh CISO policy guidance with updated controls; monitor adherence and metrics.
• Oversee administrative support for the Information Security Committee and sub-committees.
• Develop and execute a TISR risk framework; conduct risk assessments for projects, third-party, new activities, and applications.
• Track remediation of TISR issues from audits and regulatory exams; refresh policies annually.
• Support audit requests and prepare evidence for regulatory examinations.
• Ensure privacy policy compliance and oversee privacy risk assessments.
• Coordinate with cross-functional teams to align access governance with organizational goals.

Skills

Project management

Policy writing

Stakeholder management

Regulatory knowledge

Risk assessment

Communication

IT/IS risk management

CISSP/CRISC preferred

Education

Bachelor’s Degree in Business, Risk, Data, Computer Science, Management Information Systems, Engineering, Mathematics, or related field

Job description

Bank of China in New York, NY seeks an information security leader to drive Strategy, Programs, Governance, Risk, and Compliance for the US operations. You will coordinate security strategy, manage CISO projects, and oversee policy development, training, and metrics to ensure strong governance and regulatory alignment.

You will conduct risk assessments, manage privacy programs, and coordinate audits while guiding cross-functional teams to implement robust controls aligned with NIST/FFIEC