Senior Vice President, Information Security

BNY; Washington (District of Columbia); On-site; USD 130,000 - 170,000; Full time

Job summary

BNY seeks a Senior Information Compliance Specialist to join the Information Security Division - Business Information Security Office in Washington, DC. The role focuses on FedRAMP High, NIST RMF, and FISMA compliance, leading ATO processes, and maintaining security documentation.

The candidate should have 10+ years in information security, federal compliance experience, and certifications such as CISM/CISSP/CISA. A bachelor's degree is required, advanced degree preferred.

Qualifications

• Bachelor's degree in computer science or related discipline, or equivalent work experience.
• 10+ years of experience in information security or related technology experience.
• Experience in the securities or financial services industry is a plus.
• Experience with federal compliance preferred.
• Certified Information Security Management (CISM), Certified Information Systems Security Professional (CISSP), or Certified Information Systems Auditor (CISA) preferred.

Responsibilities

• Possess deep understanding of FedRamp High and NIST RMF and FISMA.
• Develop and maintain FedRamp security documentation with frequent reviews.
• Ensure internal controls for information risk management are effective.
• Lead the Authority to Operate (ATO) processes for information systems.
• Demonstrate knowledge of information risk management best practices and control concepts.
• Perform security control assessments and provide improvement recommendations.
• Serve as the primary contact for audits, security documentation, and control compliance.
• Collaborate with technical and non-technical teams to address issues and collect risk information.
• Brief on ATO status, audit findings, remediations, and control gaps.
• Identify and assess potential threats and vulnerabilities.
• Prepare and coordinate evidence for audits and respond to findings.

Skills

FedRAMP High

NIST RMF

FISMA

ATO processes

information risk management

security assessments

audits liaison

risk communication

Education

Bachelor's degree in CS or related

Advanced degree preferred

Tools

CISM

CISSP

CISA

Job description

Job Description
We're seeking a future team member for the role of

Washington, DC
In this role, you'll make an impact in the following ways:

• Possess deep understanding of the FedRamp High and National Institute of Standards and Technology (NIST) Risk Management Framework and supporting legislation such as the Federal Information System Modernization Act of 2014 (FISMA).
• Develop and maintain comprehensive security documentation required by FedRamp, including conductive frequent reviews and updates for continued accuracy.
• Ensures internal controls related to information risk management are effective and drive the review of continued compliance to FedRamp High requirements.
• Lead the Authority to Operate (ATO) processes for information systems.
• Demonstrate a breadth of knowledge of information risk management best practices and a thorough understanding of control and risk management concepts.
• Perform security control assessments, including establishing metrics and measures to assess security control effectiveness, and provide recommendations for any areas of improvement.
• Serve as the primary point of contact for all inquiries pertaining to audits, security documentation, and control compliance.
• Displays the ability to collaborate with team members (technical and non-technical) to ensure issues are addressed and relevant technical risk information is collected.
• Provide briefings on the ATO status, audit findings and remediations, and current control gaps.
• Contribute to reducing the likelihood of negative reputational and regulatory due to non-compliance with the Bank's information risk management policies and standards, including local procedures specific to the assigned business/business partner areas.
• Identify and assess potential threats and vulnerabilities.
• Prepare and coordinate the evidence required for audits, including responding to any audit findings.

Job Description
We're seeking a future team member for the role of Senior Information Compliance Specialist to join our Information Security Division - Business Information Security Office. This role is located in Washington, DC
In this role, you'll make an impact in the following ways:

• Possess deep understanding of the FedRamp High and National Institute of Standards and Technology (NIST) Risk Management Framework and supporting legislation such as the Federal Information System Modernization Act of 2014 (FISMA).
• Develop and maintain comprehensive security documentation required by FedRamp, including conductive frequent reviews and updates for continued accuracy.
• Ensures internal controls related to information risk management are effective and drive the review of continued compliance to FedRamp High requirements.
• Lead the Authority to Operate (ATO) processes for information systems.
• Demonstrate a breadth of knowledge of information risk management best practices and a thorough understanding of control and risk management concepts.
• Perform security control assessments, including establishing metrics and measures to assess security control effectiveness, and provide recommendations for any areas of improvement.
• Serve as the primary point of contact for all inquiries pertaining to audits, security documentation, and control compliance.
• Displays the ability to collaborate with team members (technical and non-technical) to ensure issues are addressed and relevant technical risk information is collected.
• Provide briefings on the ATO status, audit findings and remediations, and current control gaps.
• Contribute to reducing the likelihood of negative reputational and regulatory due to non-compliance with the Bank's information risk management policies and standards, including local procedures specific to the assigned business/business partner areas.
• Identify and assess potential threats and vulnerabilities.
• Prepare and coordinate the evidence required for audits, including responding to any audit findings.

To be successful in this role, we're seeking the following:

• Bachelor's degree in computer science or a related discipline, or equivalent work experience required, advanced degree preferred.
• 10+ years of experience in information security or related technology experience required, experience in the securities or financial services industry is a plus
• Experience with federal compliance preferred.
• Demonstrated experience managing or executing successful ATO processes preferred.
• Certified Information Security Management (CISM), Certified Information Systems Security Professional (CISSP), or Certified Information Systems Auditor (CISA) security certification preferred.
• Demonstrate deep understanding