Business Information Security Officer-VP

State Street•Austin, TX

3d•$120,000 - $202,500

About The Position

The Vice President, Business Information Security Officer (BISO) provides first-line cyber risk management oversight to State Street business lines and legal entities, reporting to a Senior BISO / Managing Director. The role leads a small team delivering cyber advisory services, application and service-level threat models, a business-aligned cyber book of work, and risk metrics that support informed decision-making. The BISO is a trusted advisor and strategic change agent who embeds security within the business. The role builds relationships with senior leaders, communicates technical risks in business terms, influences adoption of cyber controls, and presents to executive leadership and, where relevant, regulators. It assesses cyber risk across applications, platforms, systems, and critical business services; recommends protections; and helps improve cyber resilience and incident-response readiness. The position also advises on digital asset and blockchain security, including tokenization, custody, wallets, cryptographic key management, HSM and MPC-based signing, cold storage, smart contracts, blockchain infrastructure, third parties, and response to suspicious or unauthorized activity. The BISO works with business, technology, security, risk, legal, compliance, and regulatory stakeholders to define practical control expectations. The role requires practitioner-level technical knowledge across areas such as cloud and platform security, networking, security architecture, IAM, secure development, software supply-chain security, vulnerability management, security operations, AI risk, and digital asset controls.

Requirements

At least 6 years of information security experience in an operational or analytical capacity.
At least 4 years of experience within financial services.
Bachelor’s degree in computer science, information security and assurance, or a related technical field, or equivalent aligned work experience.
Practitioner-level technical depth across several cyber domains, including cloud and modern platform security, networking, security architecture, blockchain fundamentals, or digital asset custody controls.
Ability to assess cyber risk at application, platform, and system levels and recommend appropriate mitigations.
Knowledge of cyber risk measurement, risk appetite, risk acceptance, issue management, triage, remediation tracking, and residual-risk scoring.
Experience working with the NIST Cybersecurity Framework.
Experience with business concepts including finance, business requirements, compliance, and risk management.
Familiarity with applicable regional regulatory guidance for supported jurisdictions.
Strong analytical, written and verbal communication, research, organizational, interpersonal, active-listening, dependability, and teamwork skills.
Ability to communicate technical risks to technical and nontechnical audiences and exercise sound judgment when assessing emerging technology.
Good understanding of agile methods, tools, procedures, and iterative decision-making.
Ability to recognize knowledge gaps and describe how to obtain needed information.

Nice To Haves

CISSP/CISP certification preferred.
Blockchain and digital asset security certifications, such as Certified Blockchain Security Professional (CBSP), are desirable.
Practical experience with digital asset custody, wallet infrastructure, HSMs, MPC technologies, transaction-signing controls, smart contracts, tokenization platforms, or blockchain security assessments is strongly preferred.
Qualitative cyber risk analysis experience is highly preferred.
AWS or Azure cloud security experience is preferable but not required.
Experience with Agentic AI use cases and deployments is a plus.
Practical experience with blockchain, digital assets, tokenization, custody, wallet infrastructure, smart contracts, HSM-based key management, cold storage, transaction-signing controls, or digital asset platform risk assessments is strongly preferred.

Responsibilities

Lead a small team supporting aligned business stakeholders and execute a cyber book of work aligned to the business.
Partner with senior business and technology leaders, providing timely data to support decision-making, prioritization, and risk-based trade-offs.
Continuously engage business units to manage risks in line with risk appetite and escalate open risk items to business leadership.
Perform application-, platform-, and system-level cyber risk assessments, identify vulnerabilities and threats, analyze impacts, and determine required protections.
Integrate information security risk reviews into Incident Management, Vulnerability Management, Third-Party Risk Review, Cyber Resiliency, eSDLC, and Change and Project Management processes.
Represent global cybersecurity on business control committees, risk committees, and specialized forums with executive management, audit, technology risk, compliance, legal, and regulatory stakeholders.
Prepare and deliver executive-ready presentations and briefings on protection needs, threat models, and control outcomes.
Advise on blockchain and digital asset risk across tokenization, custody, wallet operations, transaction authorization and signing, smart contracts, infrastructure, and third-party services.
Challenge custody and key-management designs, including HSM use, cold storage, private-key lifecycle management, backup and recovery, quorum approvals, segregation of duties, break-glass access, and operational resilience.
Coordinate with security architecture, application and cloud security, IAM/PAM, SOC/SIEM, vendor risk, risk management, legal, compliance, and technology teams to define practical digital asset control expectations.
Assess security and operational controls for digital asset custody, including key generation, backup, recovery, rotation, destruction, transaction approval workflows, and non-repudiation.
Evaluate transaction authorization controls, including maker/checker processes, approval thresholds, privileged access, monitoring, and exception handling.
Support on-chain monitoring and digital asset incident response, including suspicious-activity alerts, fraud indicators, wallet compromise, unauthorized transactions, and escalation procedures.
Translate technical risk into clear, actionable business terms and build effective relationships across business and control functions.
Use dashboards and data-mining tools to develop cyber risk profiles, and stay current on emerging threats, technologies, and trends.