Senior Director, Cyber GRC & Policy Frameworks

BNY Mellon; New York (NY); On-site; USD 210,000 - 270,000; Full time

Job summary

BNY Mellon seeks a Senior Director of Information Security to lead cyber governance, policy development, and control framework modernization from its New York office. The role emphasizes building a unified cyber control taxonomy, aligning controls to enterprise risks and regulatory obligations, and partnering with technology stakeholders to embed policy requirements early in the lifecycle.

The ideal candidate has extensive experience in cyber GRC, risk management, and governance, with strong

Qualifications

• Significant experience in Cyber GRC, technology risk, and control frameworks.
• Ability to translate regulatory and audit requirements into practical control requirements.
• Strong written communication and stakeholder management skills.

Responsibilities

• Lead development, maintenance, and modernization of cyber governance frameworks, policies, standards, and control principles.
• Define and maintain a common cyber control taxonomy and framework aligned to risk, regulatory obligations, and tech domains.
• Rationalize control inventories to reduce duplication and improve consistency across platforms.
• Map controls to risks, policy requirements, standards, obligations, important services, and owners.
• Establish and govern exception processes for cyber standards and control requirements.

Skills

Cyber GRC

Policy management

Control framework management

Regulatory mapping

Stakeholder management

Education

Bachelor’s degree in CS or related

Advanced degree preferred

Tools

Security governance tools

Job description

BNY Mellon seeks a Senior Director of Information Security to lead cyber governance, policy development, and control framework modernization from its New York office. The role emphasizes building a unified cyber control taxonomy, aligning controls to enterprise risks and regulatory obligations, and partnering with technology stakeholders to embed policy requirements early in the lifecycle.

The ideal candidate has extensive experience in cyber GRC, risk management, and governance, with strong