Senior Information Compliance Lead - FedRamp & RMF

Archer; Washington (District of Columbia); On-site; USD 104,000 - 253,000; Full time

Job summary

BNY is seeking a Senior Information Compliance Specialist to join its Information Security Division in Washington, DC and Lake Mary, FL. You will drive FedRamp High compliance, manage RMF controls, and lead ATO processes for critical information systems.

The role requires 10+ years of security experience, relevant certifications, and the ability to coordinate audits, prepare evidence, and brief senior leadership on risk and remediation efforts.

Qualifications

• Bachelor's degree in computer science or a related discipline, or equivalent work experience required; advanced degree preferred.
• 10+ years in information security; securities/financial services a plus.
• Experience with federal compliance preferred.
• Demonstrated success leading ATO processes and security program execution.
• Certifications such as CISM, CISSP, or CISA preferred.
• Strong understanding of FISMA and NIST SP 800-53/800-37/800-171.

Responsibilities

• Lead the Authority to Operate (ATO) processes for information systems.
• Develop and maintain FedRamp security documentation and procedures.
• Serve as primary contact for audits, audits findings, and compliance.
• Provide briefings on ATO status, findings, and remediations.
• Collaborate with technical and non-technical teams to remediate risks.
• Identify threats and vulnerabilities and coordinate evidence for audits.

Skills

FedRamp High

NIST RMF

FISMA

ATO processes

Audit coordination

RMF

M365 proficiency

Security controls

Education

Bachelor's degree in computer science or related field

10+ years information security experience

CISM

CISSP

CISA

Job description

BNY is seeking a Senior Information Compliance Specialist to join its Information Security Division in Washington, DC and Lake Mary, FL. You will drive FedRamp High compliance, manage RMF controls, and lead ATO processes for critical information systems.

The role requires 10+ years of security experience, relevant certifications, and the ability to coordinate audits, prepare evidence, and brief senior leadership on risk and remediation efforts.