Head of Cyber & Information Security Oversight (SVP)

State Street; Boston (MA); On-site; USD 225,000 - 338,000; Full time

Benefits offered by this job

401(k) match

Medical/dental/vision coverage

Paid time off & volunteer days

Flexible work arrangements

Job summary

State Street is seeking an SVP to lead Cyber & Information Security Oversight within Enterprise Technology Risk Management. You will establish global cybersecurity risk oversight, advise the global CISO, and partner with regulators to address issues and improve controls.

The role requires 15+ years in financial services or technology, with executive-level experience, CISSP, and a proven ability to translate technical risk into business risk for senior IT leaders and the Board.

Qualifications

• 15+ years in financial services or technology with executive-level cybersecurity experience.
• CISSP or equivalent certification.
• Advanced degree in technology or related field.
• Experience leading global cyber risk programs.

Responsibilities

• Establish and operate the global Cybersecurity Risk Oversight function in ETRM.
• Advise the global CISO function and program.
• Lead regulatory interactions with major authorities and regulators.
• Communicate risk insights to executives and the Board.

Skills

Executive presence

Business risk translation

Regulatory exams

Mentoring

Cross-functional leadership

Education

15+ years experience

Advanced tech degree

CISSP certification

Executive cybersecurity ops

Job description

SVP, Head of Cyber & Information Security Oversight

Why this role is important to us

Enterprise Technology Risk Management (ETRM) is responsible for thought leadership, oversight, monitoring, and advisement around the discovery and remediation of Cyber and Technology Risks across the enterprise. ETRM plays an important role in the overall success of the organization, and our mission is to establish a world class Technology Risk Management program that aligns business and technology risk to enable effective decision making. The organization is going through a significant transformation, and you will lead key cyber risk assessments on material projects and ensure the identified risks are being prudently managed. This position will also include providing thought leadership and support to both your peers in ETRM and your stakeholders in the business and corporate areas. You will need to periodically participate in meetings with our key regulators and provide support and advice to your stakeholders during regulatory exams and regulatory finding validations.

Who We Are Looking For

We are looking for a proven Cyber and Information Security Risk Leader with more than 15 years of experience in the financial services and/or technology industry. The qualified candidate will have a combination of:

• Deep Technical Experience: Hands-on Cybersecurity leader in roles as a CISO or CTRO at comparable organizations with a global footprint or at a Deputy CISO level in a G‑SIB. The candidate will be well versed in identifying, assessing, managing and monitoring cyber risks across several domains such as Identity and Access, Information Protection, Threat and Vulnerability Management, Cyber Incident and Response, Application security, Secure configuration, Security Architecture and Cyber Risks related to Third parties.
• Strong Business background: Proven capability for translating this technical understanding into business risk to be able to provide guidance to and challenge senior level IT executives such as the group level State Street CIO, CISO and CTO. The individual will also serve as an advisor to the Head of ORM, Group CRO, regional CROs and the State Street Board of Directors to manage Cyber Risk adequately.
• Strong Executive Presence: effectively communicate with senior executives at the EVP and C-level, the Board and with regulators globally to foster confidence in the Bank's risk management capabilities and to drive enhancements where needed. Candidates must demonstrate strong initiative, be able to perform well under pressure and be capable of managing multiple and diverse assignments.

What You Will Be Responsible For

• Establish and Operate the global Cybersecurity Risk Oversight function in ETRM.
• Be a risk advisor and challenge function to the State Street Global CISO function and program.
• Establish State Street's Cyber Risk Appetite, with corresponding policies and Metrics and thresholds, reporting breaches, escalating exceptions and challenging risk acceptances and provide guidance on improving the risk position to support the business
• Be an acknowledged thought leader in the industry, with a strong understanding of attributes of an effective Cybersecurity program at peer organizations
• Analytics and Reporting
• Establish an analytics capability to provide cyber risk insights, leveraging AI for greater effectiveness
• Develop risk reports customized to the business needs of legal entities and regions to drive risk reduction in a cost-effective way.
• Cyber Risk Governance
• Lead or co-Chair various senior governance forums like the Cybersecurity Risk Committee and the Vulnerability Governance Forum that manage Cybersecurity risk to State Street
• Communicate and drive effective implementation of ETRM risk management policies, framework, tools, guidelines and standards across the business ensuring cyber risks are identified and managed effectively.
• Ensuring cyber risks and non-compliance with internal and external standards are proactively identified, prudently managed, and effectively challenged
• Identifying/assessing/controlling/monitoring risks and supporting FLOD in planning/executing controls and additional compensating controls
• Review and challenge the first line cyber controls assurance program and the constituent cyber processes
• Provide challenge to the EVPs leading the Cyber Enterprise Processes and foster deeper and integrated FLOD/SLOD relationships and embedded, proactive risk management
• Advise FLOD in prioritization of risks, risk initiatives, risk mitigation alternatives
• Regulatory
• Lead second line regulatory interaction for Cyber Risk with regulators, including the FCA/PRA, HKMA, MAS, APRA and ECB, including resolution of issues and concerns
• Be a thought leader for managing emerging Cybersecurity risks to provide credible risk management guidance to the regulators
• Consistent, Global Risk Management
• Collaborate with and support regional) and Business Unit Risk Management peers in matters related to cyber and information security risks
• Develop and deliver the ETRM Cybersecurity annual Book of Work (risk assessments, continuous monitoring, issues management and reporting) through the established risk leads within the team while leveraging the ETRM India GCC.
• Coordinate across multiple risk types in Operational Risk Management, like Data Risk, Fraud and Third-Party Risk programs. Utilize available Enterprise Risk and Operational risk management tools (NBPRA, MRI, RCSA, KRI’s, Incident data, Loss event data) in conjunction with other environmental changes to proactively monitor the control environment and identify and address potential weaknesses and/or gaps in a timely manner
• Keep abreast of new products, services, technologies and applications as well as their respective impact on the organization’s risk profile

What We Value

These skills will help you succeed in this role

• Strong ability to collaborate effectively
• This position requires interacting with "C" level suite, so superior communication, interpersonal, negotiation, presentation and intergroup skills are critical for success
• The ability to translate technical issues into risk terms that business can understand is necessary
• Experience with regulatory exams and responses is strongly desired
• Being an effective mentor and coach
• Ability to be a strong voice for review and challenge while continuing to maintain positive relationships with business stakeholders
• An ability to be a leader within their team, as well as being a leader amongst your peers

Education & Preferred Qualifications

• Minimum 15 years of experience in the financial, and or technology industries, with at least 5 years in executive roles as a CISO, Deputy CISO or equivalent in a G-SIB
• Advanced degree or undergraduate degree in technology / cyber disciple or equivalent
• Experience in first line cybersecurity operations
• CISSP or equivalent is required
• Working knowledge of industry and regulatory risk and control standards and frameworks such as FFIEC, DORA, NIST-CSF, 800-53, COBIT, CCM, and MITRE ATT&CK is expected

Are you the right candidate? Yes! We truly believe in the power that comes from the diverse backgrounds and experiences our employees bring with them. Although each vacancy details what we are looking for, we don't necessarily need you to fulfil all of them when applying. If you like change and innovation, seek to see the bigger picture, make data driven decisions and are a good team player, you could be a great fit.

About State Street

What we do. State Street is one of the largest custodian banks, asset managers and asset intelligence companies in the world. From technology to product innovation, we're making our mark on the financial services industry. For more than two centuries, we've been helping our clients safeguard and steward the investments of millions of people. We provide investment servicing, data & analytics, investment research & trading and investment management to institutional clients.

Work, Live and Grow. We make all efforts to create a great work environment. Our benefits packages are competitive and comprehensive. Details vary by location, but you may expect generous medical care, insurance and savings plans, among other perks. You'll have access to flexible Work Programs to help you match your needs. And our wealth of development programs and educational support will help you reach your full potential.

Discover more at StateStreet.com/careers

Salary Range:

$225,000 - $337,500 Annual

The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street's comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.

For a full overview, visit https://hrportal.ehr.com/statestreet/Home.

About State Street

Across the globe, institutional investors rely on us to help them manage risk, respond to challenges, and drive performance and profitability. We keep our clients at the heart of everything we do, and smart, engaged employees are essential to our continued success.

We are committed to fostering an environment where every employee feels valued and empowered to reach their full potential. As an essential partner in our shared success, you'll benefit from inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks that keep you connected to what matters most. Join us in shaping the future.

As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.

Discover more information on jobs at StateStreet.com/careers

Read our CEO Statement

Job Application Disclosure:

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

Job ID: R-780933