Information Security Risk Manager

Bloomberg; New York (NY); On-site; USD 120,000 - 180,000; Full time

Job summary

Bloomberg is seeking an Information Security Risk Manager to unite cybersecurity knowledge, risk management disciplines, and strong analytical capabilities in a credible oversight role.

You will report to the Head of Information Security Risk and work with Security, CISO, Engineering, Technology Risk, and Enterprise Risk Management to identify, assess, communicate, and resolve cybersecurity risks across programs.

Qualifications

• Bachelor’s degree or equivalent professional experience.
• 5+ years of relevant experience across Security Engineering, Security Architecture, Application Security or related technical discipline.
• Familiarity with NIST CSF, NIST 800-53, MITRE ATT&CK, ISO 27001, COBIT or CIS.

Responsibilities

• Support Second Line oversight and credible challenge of cybersecurity and information security risks across the organization.
• Assess security risks and consult on the design and effectiveness of security controls.
• Review security programs and initiatives for alignment with enterprise risk standards and regulatory expectations.
• Partner with Information Security, CISO, Engineering, Technology Risk, and Enterprise Risk Management teams to strengthen risk awareness and control ownership.
• Analyze security findings, incidents, control weaknesses and risk scenarios to identify root causes and opportunities for improvement.
• Develop practical recommendations to address identified security and control risks.
• Assist in developing cybersecurity risk assessments, reporting, metrics and materials for governance forums.
• Monitor emerging threats, regulatory developments and industry practices for relevance.

Education

Bachelor's degree or equivalent

Job description

We’re looking for an Information Security Risk Manager who can bring together cybersecurity knowledge, risk management, and strong analytical skills.

Reporting to the Head of Information Security Risk within the Chief Risk Office, you will support independent oversight and credible challenge across the firm’s information security program. You will work closely with colleagues across Information Security, CISO, Engineering, Technology Risk, and Enterprise Risk Management to identify, assess, communicate, and resolve cybersecurity risks.

This role is well suited to someone with a strong foundation in cybersecurity who is looking to broaden their experience within an independent risk oversight function. You will have exposure to a range of security topics, from technical security findings and control effectiveness to cyber resilience, emerging threats, and regulatory requirements. You will help translate technical security risks into clear, actionable insights and support the organization in understanding where controls can be strengthened and risks appropriately managed.

Key Responsibilities

• Support Second Line oversight and credible challenge of cybersecurity and information security risks across the organization.
• Assess security risks and consult on the design and effectiveness of security controls across technology initiatives and security programs.
• Review security programs and initiatives to assess alignment with enterprise risk standards, established security frameworks, and regulatory expectations.
• Partner with Information Security, CISO, Engineering, Technology Risk, and Enterprise Risk Management teams to strengthen risk awareness, accountability, and control ownership.
• Analyze security findings, incidents, control weaknesses, and risk scenarios to identify themes, root causes, and opportunities for improvement.
• Develop practical recommendations to address identified security and control risks.
• Assist in developing cybersecurity risk assessments, reporting, metrics, and materials for management and governance forums.
• Monitor emerging cybersecurity threats, regulatory developments, and industry practices and assess their potential relevance to the organization.
• Participate in risk assessments of areas including cloud security, application security, identity and access management, cyber defense, vulnerability management, and cyber resilience.
• Build strong relationships across technical and risk teams and provide thoughtful, constructive challenge when appropriate.

Required Qualifications

• Bachelor’s degree or equivalent professional experience.
• 5+ years of relevant experience across Security Engineering, Security Architecture, Application Security, Cyber Defense, or a related technical discipline.
• Working knowledge of cybersecurity risks, controls, and security principles.
• Experience assessing technology or security risks and communicating findings and recommendations to stakeholders.
• Familiarity with one or more cybersecurity or technology control frameworks, such as NIST CSF, NIST 800-53, MITRE ATT&CK, ISO 27001, COBIT, or CIS.
• Strong written and verbal communication skills, including the ability to explain technical risks to both technical and non-technical audiences.
• Ability to work collaboratively across technology, security, and risk teams.
• Authorized to work in the United States.

Preferred Qualifications

• Experience conducting assessments as part of Information Security, Technology Risk, Risk Management, Internal Audit, Security Architecture, or another technology control function.
• Relevant technical or professional certification such as CISSP, CISM, CRISC, CISA, GIAC, or FAIR.
• Familiarity with enterprise risk management concepts and risk assessment methodologies.
• Experience within a regulated industry, including financial services, is helpful but not required.

Core Competencies

• Strong analytical and problem-solving skills.
• Technical depth in one or more security domains.
• Ability to assess information objectively and provide constructive challenge.
• Clear and concise written and verbal communication.
• Strong collaboration and stakeholder-management skills.
• Ability to manage multiple priorities in a fast-moving environment.
• Attention to detail while maintaining an understanding of broader risk implications.
• High integrity, sound judgment, and a commitment to independent risk management.