Business Information Security Officer-AVP

State Street•Quincy, MA

12d

About The Position

The AVP , Cyber Risk Advisor provides cyber risk advisory services focused on strengthening the firm's defensive cybersecurity posture through proactive risk management, cyber control oversight, vulnerability reduction, and security-by-design practices. The role serves as a trusted advisor to technology, infrastructure, application, and business teams, ensuring cybersecurity risks are identified, assessed, and managed in alignment with enterprise standards, regulatory expectations, and risk appetite. As a member of the Business Information Security organization, the AVP Cyber Security Advisor partners closely with Security Operations, Vulnerability Management, Threat Intelligence, Engineering, Architecture, and AI Security teams to drive risk-informed decisions and measurable reductions in cyber exposure. The successful candidate combines strong technical cybersecurity knowledge with the ability to influence stakeholders and translate complex cyber risks into actionable business guidance.

Requirements

Strong technical understanding of enterprise networking concepts and security controls.
Strong experience with network security technologies , secure cloud, Secure SDLC practices
Experience in securing S oftware-as-a- S ervice delivery models (Identity, Data Protection, Monitoring, and Governance)
Ability to assess architecture diagrams and design documents for security risk.
Experience in cyber risk assessment, control evaluation, and remediation tracking.
Strong written and verbal communication skills; able to influence without direct authority.
Experience in regulated financial services or similarly complex environments.
Exposure to regulatory expectations (e.g., FFIEC, NIST, ISO, SOC, or equivalent frameworks).
Experience supporting audits, regulators, or executive risk forums.

Responsibilities

Assess cyber risks associated with infrastructure, applications, cloud services, third party supply chain, and emerging technologies.
Assess network designs, material changes, and new initiatives for security risk; review architecture artifacts and control implementations.
Provide expert guidance on risk acceptance decisions, exception handling, and residual risk posture related to network controls.
Support execution of enterprise cyber risk management objectives and control improvement initiatives across Saas platforms in support of client deliverables.
Partner with network and cloud engineering teams to embed security ‑ by ‑ design and resilience principles across on ‑ prem, cloud, and hybrid networks.
Review and influence network segmentation, trust boundaries, ingress/egress controls, and monitoring strategies.
Influence the alignment with security patterns with enterprise standards, zero trust principles, and regulatory obligations while working with cyber threat intel to build models.
Partner with GCS Security Guardians to ensure current network security principals and guidance are updated and documented.
Partner with vulnerability management teams to prioritize remediation activities based on risk.
Analyze vulnerability trends, systemic control weaknesses, and emerging threat exposures.
Provide advisory support on patch management, configuration management, and security hardening efforts.
Assist business and technology teams in developing sustainable remediation strategies.
Lead or support network security risk assessments, control gap analysis, and prioritization aligned to enterprise risk frameworks.
Track remediation of identified control gaps and provide transparent risk reporting and escalation as needed.
Support internal audits, regulatory reviews, and risk committees by articulating network security posture and key risks.
Provide advisory support during cyber incidents and events , including impact analysis, containment strategy guidance, and participate in playbook refinement.
Partner with threat intelligence teams , cyber defense center , and vulnerability management teams to interpret emerging threats , model exposure, and appropriate remediation.

Benefits

retirement savings plan (401K) with company match
insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages
paid-time off including vacation, sick leave, short term disability, and family care responsibilities
access to our Employee Assistance Program
incentive compensation including eligibility for annual performance-based awards
eligibility for certain tax advantaged savings plans
inclusive development opportunities
flexible work-life support
paid volunteer days
vibrant employee networks