Cyber incident management - VP : Job Level - Vice President

Morgan Stanley•New York, NY

About The Position

In the Technology division, we leverage innovation to build the connections and capabilities that power our Firm, enabling our clients and colleagues to redefine markets and shape the future of our communities. This is a Cyber incident management position at VP level within Risk, Regulatory & Resilience, which performs various independent functions to ensure adequate controls are in place. We do this by providing an integrated risk and control framework to govern, assess, mitigate and manage financial and operational risk in Operations. Since 1935, Morgan Stanley is known as a global leader in financial services, continuously evolving and innovating to better serve our clients and our communities in more than 40 countries around the world.

Requirements

Minimum 10 years of experience with ability to synthesize complex threat intelligence and operational experience into forward-looking strategies and actionable recommendations for senior leadership.
Experience contributing to or leading industry-level forums, working groups, or publications in the cybersecurity or operational resilience space.
Experience operating within a globally distributed, follow-the-sun, 24/7 response environment.
Strong track record of designing and facilitating cyber incident simulations, tabletop exercises, and readiness programs.
Experience mentoring and developing talent within a high-performing cyber or response function.
Successful candidates combine deep cybersecurity expertise, executive-level communication skills, operational discipline, and sound judgment.
This role demands comfort operating in a fast-moving, high-stakes, and constantly evolving threat landscape - as well as the credibility and gravitas to influence senior stakeholders and shape organizational direction.
Proven ability to influence senior stakeholders and shape organizational strategy in a complex, matrixed environment.
Demonstrated track record of managing both technical and non-technical workstreams in high-pressure environments.
Deep understanding of information security, fraud, and third-party/supply chain threats and their potential business, regulatory, and reputational impact.
Experience applying risk management frameworks to assess, prioritize, and communicate risk at an enterprise level.
Professional experience in cybersecurity or security-related roles, ideally within financial services, the military, and/or intelligence communities.
Exceptional written and verbal communication skills, with a demonstrated ability to translate complex technical issues into clear, business-level risk narratives for senior executives and boards.
Bachelor’s degree in Data Science, Computer Science, Finance, or related field.

Nice To Haves

Relevant certifications such as CISSP, CISM, or SANS Institute credentials

Responsibilities

Lead and orchestrate the Firm's response to high-severity cyber, fraud, information security, and third-party incidents from detection through recovery, driving risk-based decision-making and coordinating executive-level response activities, including incident calls and internal and external communications.
Shape the Firm's risk posture during high-severity incidents by driving timely, executive-level decision-making and ensuring response strategies are informed by current threat intelligence and industry best practices.
Champion a culture of continuous improvement through structured post-incident reviews, translating operational learnings into enterprise-wide readiness enhancements - including updated playbooks, Standard Operating Procedures, and scenario-based exercises and tabletop drills with key stakeholders.
Contribute to the development of the Firm's cyber response strategy, bringing forward-looking perspectives on emerging threats, industry trends, and evolving best practices.
Own and evolve Fusion's global follow-the-sun operating model, partnering with Fusion, Cyber, Technology, and Business leadership to enhance 24/7 response effectiveness and ensure the model reflects the current threat landscape.