Business Information Security Officer- VP

State Street • Boston, MA

3d • $120,000 - $202,500 • Hybrid

About The Position

The Vice President, Business Information Security Officer (BISO) provides cyber risk management oversight to State Street business lines and legal entities as part of the first line of defense. Embedded in a small team, the role provides cyber advisory services, executes cybersecurity work aligned with business units, and delivers metrics and cyber-driven content to support business decision-making. Responsibilities span information security and risk management, cyber incident and response management, cyber controls analysis, and cyber reporting.

The BISO acts as a trusted advisor, change agent, and thought leader. The role builds trust with senior executives through information and transparency, presents technical and business details to senior leadership, and influences adoption of cyber controls to reduce residual risk.

The position requires strong technical judgment, including the ability to understand emerging technologies and their security requirements, analyze cyber controls, connect the firm's risk taxonomy to business processes, and assess residual risks across business functions and critical services. The BISO performs application-, platform-, and system-level cyber risk assessments and recommends protections that strengthen cybersecurity and incident-response preparedness. Practitioner-level depth is expected in at least five security domains.

Global Cybersecurity manages cyber risk across State Street entities by providing actionable insights and supporting the firm's cyber risk culture. The BISO function embeds security within the business and serves as a conduit between Global Cybersecurity and business units, advising on policy, standards, and control compliance and promoting cyber awareness.

The role follows a hybrid work arrangement according to location, with working hours of 9 a.m. to 5 p.m. Eastern Time and off-hours on-call coverage as needed. The annual salary range is $120,000 to $202,500 for the primary location; the range may differ for other locations.

Requirements

• Bachelor’s degree in computer science or a related technical field, or equivalent work-aligned experience.
• Ten or more years of progressive cybersecurity and risk leadership experience, including governance, risk, and compliance; experience in regulated financial services is preferred.
• Practitioner-level depth in at least five cybersecurity domains aligned with the BISO technical skills model.
• Strong technical cybersecurity background; experience in areas such as security operations, operations, networking, or engineering is preferred.
• Ability to influence executives and translate technical risk into business language.
• Ability to work across audit, regulatory, and third-party risk domains.
• Strong analytical and interpersonal skills, including active listening, dependability, and teamwork.
• Ability to understand and assess risks associated with Generative AI, distinguish Generative AI from Agentic AI and traditional Machine Learning, and understand model and frontier-model risk management.
• Understanding of risk measurement, trade-offs, and risk-acceptance decisions aligned with risk appetite.
• Familiarity with recognized standards and frameworks such as NIST CSF 2.0, NIST SP 800-53, and ISO 27001.
• Understanding of issue management, triage, remediation tracking, and residual-risk scoring.
• Availability for 9 a.m. to 5 p.m. Eastern Time working hours and off-hours on-call coverage as needed.

Nice To Haves

• CISSP or CISM certification is strongly preferred.
• CRISC, CISA, SSCP, CCSP, CEH, or GIAC certifications are highly valued.
• Preferred technical cybersecurity experience in areas such as security operations, operations, networking, or engineering.
• Experience in regulated financial services.

Responsibilities

• Partner with senior business and technology leaders by delivering timely data that enables informed decisions, prioritization, and risk-based trade-offs.
• Oversee and actively manage risks in line with risk appetite through ongoing business-unit engagement, escalating open risk items to aligned business leadership.
• Collaborate with stakeholders to identify information assets and assess protection needs across lines of business and legal entities.
• Conduct cyber risk assessments at the application, platform, and system levels; identify vulnerabilities and threats, analyze potential impacts, and determine protections required under Global Cybersecurity standards.
• Represent Global Cybersecurity on business control committees, risk committees, and specialized forums.
• Prepare and deliver executive-ready presentations and briefings on protection-needs outcomes, threat models, and control results to mid- and senior-level leaders.
• Report significant changes in information security risk to appropriate management on periodic and event-driven bases.
• Serve as an on-call contact for cybersecurity governance matters as needed, facilitating risk-based decisions, incident guidance, and timely escalation of material issues.
• Establish relationships with business risk executives, third-party management, client relations, global technology services, second and third lines of defense, and internal regulatory teams.
• Translate technical risk into clear, actionable business terms for technical and non-technical audiences.
• Use dashboards and data-mining tools to build cyber risk profiles.
• Stay current on emerging threats, technologies, and trends, and explain how to obtain information when knowledge gaps arise.

Benefits

• Retirement savings plan (401(k)) with company match.
• Basic life, medical, dental, vision, and long-term disability insurance, with other optional coverage available.
• Paid time off, including vacation, sick leave, short-term disability, and family-care responsibilities.
• Access to an Employee Assistance Program.
• Eligibility for annual performance-based incentive awards, except certain sales roles covered by sales incentive plans.
• Eligibility for certain tax-advantaged savings plans.
• Inclusive development opportunities, flexible work-life support, paid volunteer days, and employee networks.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior