Chief Information Security Officer (CISO)

Houlihan Lokey • Los Angeles, NY

1d • $325,000 - $350,000

About The Position

The Chief Information Security Officer leads information security for Houlihan Lokey, a global investment bank whose business depends on client confidence. The CISO is accountable for protecting information across the firm’s global platform and serves as the senior security voice to executive management, the audit committee, and the Board. The role combines security strategy and standards with hands-on incident leadership, balancing protection with the needs of the business.

The CISO leads the firm’s security and governance teams, owns the security investment portfolio, and partners with Technology, Legal, Compliance, and business teams to maintain a strong security posture while enabling the firm’s work. Responsibilities include setting the security strategy and operating model, directing security operations, managing identity and data protection, strengthening application security and human-risk programs, overseeing third-party risk, and meeting regulatory, privacy, and client requirements.

The position requires at least 15 years of progressive information security experience, including five or more years leading an enterprise security function in a global, regulated environment. A bachelor’s degree in Information Technology, Computer Science, or a related field is required. A master’s degree or MBA is preferred. The stated salary range is $325,000–$350,000; actual compensation may vary based on qualifications, experience, and work location. The firm offers a competitive benefits package, with current offerings referenced in its 2026 Benefits information.

Requirements

• 15+ years of progressive information security experience, including at least 5 years leading an enterprise security function in a global, regulated environment.
• Demonstrated ownership of a full security program, built or matured against a recognized framework such as the NIST Cybersecurity Framework or ISO 27001.
• Experience reporting to boards, audit committees, and regulators, and translating technical risk into business terms and metrics.
• Deep working knowledge of security operations, identity and privileged access, cloud security, zero-trust access, data protection, and application security.
• Proven incident response leadership, including coordination with external counsel, response partners, and executives.
• Experience writing and enforcing policy in a professional services or partnership culture.
• Bachelor’s degree in Information Technology, Computer Science, or a related field.
• Ability to communicate clearly and credibly at every level and influence without relying on authority.
• Ability to balance judgment and pragmatism, enabling new technology safely rather than defaulting to restriction.
• Ability to hold a firm line where it matters while preserving strong working relationships.
• Ability to stay composed and decisive under pressure and take full ownership of outcomes.

Nice To Haves

• Master’s degree or MBA.
• CISSP, CISM, or equivalent certification, along with a current cloud security certification.
• Experience in investment banking or another regulated financial services environment.
• Experience leading security due diligence and integration for acquisitions.
• Experience consolidating a multi-vendor security stack and securing a hybrid estate through a cloud migration.
• Experience governing AI-assisted development and tools built by business users.

Responsibilities

• Own the firm’s information security strategy, operating model, budget, and multi-year roadmap, based on a risk assessment against the NIST Cybersecurity Framework and a prioritized maturity plan with measurable milestones.
• Partner with Legal and Compliance to author security policies and standards, and manage their firm-wide communication and enforcement.
• Deliver risk-based reporting to senior management, the audit committee, and the Board, and lead the firm’s cybersecurity governance forum.
• Direct security operations with managed detection and response and SOC providers, including SIEM modernization, monitoring across endpoint, identity, cloud, and SaaS, AI-enabled triage and response, and 24/7 incident response.
• Own identity and access management, including multifactor and passwordless authentication, privileged access, and least-privilege access models.
• Mature vulnerability and exposure management across internal, external, and cloud environments, with clear remediation ownership and service levels.
• Own data protection and governance, including classification, encryption, data loss prevention, and support for legal and discovery requests.
• Establish application security standards for professional and business-led development, including guardrails for AI-enabled development and agentic tooling.
• Lead the human-risk program, including phishing simulations, red-team exercises, and heightened protection for publicly visible executives.
• Rationalize the security tool portfolio and own vendor and third-party security risk, including security due diligence for acquisitions.
• Ensure compliance with regulatory, privacy, and client contractual requirements, and lead responses to audits, regulator inquiries, and client due diligence.
• Build, lead, and develop the information security and governance, risk, and compliance teams.

Benefits

• Competitive benefits package; current benefit offerings are referenced in the firm’s 2026 Benefits information.
• Compensation may include discretionary incentive compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Executive