Strategic CISO - Programs, Strategy & GRC

Bank of China USA; New York (NY); On-site; USD 65,000 - 150,000; Full time

Job summary

Bank of China USA is seeking a senior information security leader to drive strategy, governance, risk and compliance programs across the organization. The role includes coordinating strategy, managing CISO projects, and ensuring adherence to data privacy and regulatory requirements.

Responsibilities span policy development, risk assessments, training, and reporting, with collaboration across IT, business units, and regulators.

Qualifications

• Bachelor’s degree in a related field.
• Minimum 5 years in Risk Management, Audit, IT/IS Operations, or similar functions.
• Experience in IT/IS Risk programs, projects, and policies (3+ years).
• Knowledge of US banking regulations and IT/IS risk frameworks.
• Strong program, project management, and policy-writing skills.

Responsibilities

• Coordinate Information Security strategy aligned with branch strategy.
• Lead and manage CISO programs including Information Security and Data Privacy programs.
• Establish and maintain Information Security policies and procedures.
• Conduct risk assessments and manage TISR framework and controls.
• Prepare evidence for audits and regulatory exams and respond to inquiries.
• Oversee data privacy strategy, training, and risk assessments.
• Manage metrics and reporting for the CISO function.
• Oversee Identity & Access Management governance and recertification processes.

Skills

Project management

Risk management

Policy development

Regulatory familiarity

Stakeholder management

Communication

Cybersecurity governance

Education

Bachelor’s Degree in Business, Risk, Data, CS or related field

Tools

NIST

ISO27002

FFIEC Guidelines

Job description

Bank of China USA is seeking a senior information security leader to drive strategy, governance, risk and compliance programs across the organization. The role includes coordinating strategy, managing CISO projects, and ensuring adherence to data privacy and regulatory requirements.

Responsibilities span policy development, risk assessments, training, and reporting, with collaboration across IT, business units, and regulators.