Senior Information Security & Compliance Lead (FedRAMP/RMF)

BNY Mellon; Washington (District of Columbia); On-site; USD 150,000 - 190,000; Full time

Job summary

BNY Mellon seeks a Senior Information Compliance Specialist to join the Information Security Division - Business Information Security Office in Washington, DC. The role emphasizes FedRAMP High, NIST RMF, FISMA compliance and ATO leadership, with extensive interaction across teams.

You will develop security documentation, coordinate audits, and provide remediation updates while collaborating with both technical and non-technical staff to mitigate information risk.

Qualifications

• Bachelor's degree in computer science or related discipline, or equivalent work experience required.
• 10+ years of information security experience; similar sector experience preferred.
• Experience with federal compliance (FISMA) and FedRAMP/NIST framework knowledge.
• Demonstrated experience managing ATO processes and security risk controls.
• Security certifications (CISM/CISSP/CISA) preferred.

Responsibilities

• Lead the Authority to Operate (ATO) processes for information systems.
• Perform security control assessments and report on effectiveness.
• Develop and maintain FedRAMP security documentation and updates.
• Coordinate audits and respond to findings to close gaps.
• Provide briefings on ATO status, findings and remediations.
• Collaborate with technical and non-technical stakeholders to address risks.
• Identify threats and vulnerabilities; strengthen internal controls.

Skills

FedRAMP High

NIST RMF

FISMA

Audit coordination

Information risk management

ATO leadership

Security documentation

Collaboration

M365 proficiency

Education

Bachelor's degree in computer science or related discipline

Advanced degree preferred

Tools

M365

Job description

BNY Mellon seeks a Senior Information Compliance Specialist to join the Information Security Division - Business Information Security Office in Washington, DC. The role emphasizes FedRAMP High, NIST RMF, FISMA compliance and ATO leadership, with extensive interaction across teams.

You will develop security documentation, coordinate audits, and provide remediation updates while collaborating with both technical and non-technical staff to mitigate information risk.