Chief Information Security Officer

BOK Financial•Tulsa, OK

5d•Onsite

About The Position

This is a senior executive role with enterprise-wide visibility, positioned to define how BOK Financial protects its systems, data and the customers who trust us with their financial lives. As Chief Information Security Officer, you will lead the enterprise information security strategy and build a security program sized to our complexity — a bank, SEC-registered investment advisers, FINRA-supervised broker-dealers, and trust and fiduciary businesses, with more than $120 billion in assets under management or administration. You will also serve as the organization’s Privacy Officer, owning the enterprise privacy program end to end. Reporting to the Chief Risk Officer, you will partner directly with executive leadership and the Board to define, assess and communicate our cyber-risk profile — inherent risk, control effectiveness, residual risk and where the trajectory is heading. You will lead security engineering, cyber threat management and response, identity and access management, and security risk and compliance, while shaping how we govern emerging risk across cloud and artificial intelligence. If you are energized by operating at scale, translating complex risk into decisions executives can act on, and building a security culture that holds up under regulatory scrutiny, this role offers exceptional visibility and real influence over the future of the enterprise.

Requirements

Bachelor’s degree in Computer Science, Information Security, Information Assurance, Technology, Risk Management, Business, or a related field, with 15+ years of progressively responsible experience in information security, cybersecurity, technology risk, or related disciplines, including 8–10+ years in senior cybersecurity leadership roles ; or an equivalent combination of education and experience.
Deep expertise in cybersecurity, information security governance, risk management, security operations, cloud security, data protection, identity and access management, incident response, and third-party risk management.
Strong knowledge of financial services regulations and industry frameworks, including banking, privacy, cybersecurity, SEC, FINRA, and other applicable regulatory and compliance requirements.
Understanding of AI, generative AI, and emerging technology governance, including data protection, third-party risk, regulatory considerations, and cybersecurity controls.
Expertise in cloud security governance and architecture, including SaaS, PaaS, IaaS, access management, encryption, monitoring, resilience, and cloud service provider oversight.
Strong knowledge of privacy governance and Privacy Officer responsibilities, including data protection, privacy risk management, breach response, regulatory compliance, and customer information protection.
Ability to develop and execute cybersecurity strategy, communicate complex risks to executive leadership, Boards, regulators, and business stakeholders, and align security initiatives with organizational objectives and risk appetite.
Proven leadership, collaboration, and decision-making skills, with the ability to build high-performing teams, lead through cyber incidents and regulatory events, influence across functions, and adapt security programs to evolving threats, technologies, and regulatory requirements.

Nice To Haves

Strongly preferred experience includes leadership of enterprise cybersecurity, privacy, cloud security, AI governance, technology risk, incident response, third-party risk management, and regulatory compliance programs within a large regulated financial services organization, including SEC-registered, FINRA-regulated, wealth management, fiduciary, and banking environments.
Experience presenting to executive leadership and Boards, supporting regulatory examinations, and leading security program transformation initiatives is preferred.
Professional certifications such as CISSP, CISM, CISA, CRISC, GIAC , or related security, risk, audit, or privacy certifications are preferred.

Responsibilities

Lead the enterprise information security program — policies, standards, controls, governance and reporting.
Define the organization’s cyber-risk profile, including inherent risk, control effectiveness, residual risk and risk trajectory against Board-approved thresholds.
Report security strategy, program effectiveness, incidents, and audit and examination outcomes to executive leadership and the Board.
Direct enterprise security operations — threat monitoring, vulnerability management, incident response, remediation and regulatory notification.
Serve as the organization’s Privacy Officer, owning privacy governance, risk assessments, training, incident response and breach notification.
Govern cloud security across SaaS, PaaS and IaaS, from architecture and identity to encryption, monitoring, resilience and cloud incident response.
Establish cybersecurity governance for AI and generative AI, including acceptable use, sensitive data protection and third-party AI risk.
Oversee third-party cyber risk from due diligence and contracting through ongoing monitoring, control validation and incident coordination.
Partner with affiliate compliance, legal and business leaders to drive SEC and FINRA regulatory readiness.
Secure a defensible, risk-based security budget by quantifying cyber risk in financial terms.
Build a high-performing security leadership team with strong talent pipelines, succession planning and a culture of accountability.