Senior Director, Business Information Security Officer (BISO)

BNY Mellon•Washington, DC

12d•$136,500 - $275,000•Onsite

About The Position

The Business Information Security Officer (BISO) is the senior security leader aligned to a platform and is responsible for embedding cyber security, cyber risk management, resilience and regulatory readiness into platform strategy, operations and change delivery. The role serves as a trusted partner to platform leadership and provides senior oversight and direction on security posture, control priorities, secure transformation and cyber risk decision-making. The BISO enables the platform to move at pace while maintaining strong risk discipline, protecting clients, data, services and the firm’s reputation. Reporting to the International CISO, this individual will operate as an embedded senior officer with strong influence across platform leadership, engineering, architecture, operations, legal, risk, compliance, audit and client-facing teams. The role requires deep cyber security expertise, excellent communication skills, strategic thinking and the ability to engage credibly with senior internal stakeholders and clients.

Requirements

Bachelor's degree in computer science or a related discipline, or equivalent work experience required, advanced degree preferred.
15+ years of experience in information security or related technology experience required.
Significant senior experience in cyber security, information security and cyber risk management within a complex, highly regulated environment.
Deep knowledge of cyber threats, security controls, vulnerability management, identity and access management, incident response, security architecture and resilience.
Strong understanding of cyber risk governance, regulatory expectations, audit engagement and issue management in financial services or similarly demanding sectors.
Demonstrated ability to engage and influence senior executives, engineering leaders, control functions and external stakeholders on complex security matters.
Proven ability to translate technical cyber issues into commercially relevant business impact, strategic options and risk-based recommendations.
Excellent written and verbal communication skills, with strong executive presence and the ability to operate effectively across complex stakeholder environments.
Strong strategic thinking, sound judgment, high personal credibility and the ability to lead through influence in a fast-paced environment.

Nice To Haves

experience in the securities or financial services industry is a plus
Experience supporting or leading client-facing discussions on security posture, controls, assurance and resilience is highly desirable.

Responsibilities

Act as the senior cyber security lead for an assigned platform, aligning security priorities to platform objectives, risk profile, regulatory obligations and strategic plans.
Serve as the primary security advisor to platform leadership, providing clear guidance on cyber threats, control effectiveness, resilience priorities and risk posture.
Own and maintain the platform cyber risk register, ensuring material risks, control gaps and vulnerability themes are identified, assessed, prioritized and actively managed.
Drive remediation of high-priority cyber risks and issues in partnership with technology, engineering, architecture and operational stakeholders.
Translate technical findings, threat intelligence, vulnerabilities and control concerns into concise business impact statements and actionable decisions for senior leaders.
Partner with security architecture and cyber engineering teams to ensure products, services, technology changes and transformation initiatives are secure by design.
Engage early in platform strategy, change and delivery forums so that cyber security requirements are addressed proactively and do not emerge as late-stage blockers.
Provide leadership during cyber incidents affecting the platform, supporting decision-making, impact assessment, communications and coordination with response teams.
Act as a senior point of contact for cyber-related audits, regulatory examinations, client security reviews and internal control assessments.
Oversee preparation of evidence, management responses and remediation activities related to security findings, control issues and regulatory expectations.
Establish a regular cadence of cyber health reporting, risk reviews and executive updates for platform leadership and the International CISO.
Influence risk acceptance, exception handling and remediation planning through sound judgment, strong challenge and pragmatic problem solving.
Build trusted relationships across platform leadership, technology, operations and control functions and represent security with credibility, clarity and commercial awareness.
Engage with clients as required on cyber security posture, control environment, resilience capabilities and risk management practices.
Promote a culture in which cyber security is understood as a business enabler that supports safe growth, innovation, operational resilience and client trust.