Controls)

BNY Mellon•New York, NY

15d

About The Position

BNY is seeking a Senior Director, Information Security to join its CyberSecurity team in New York. The role leads the development, maintenance, and modernization of cyber governance frameworks, policies, standards, and control principles. It establishes a common cyber control taxonomy and framework aligned with enterprise risk, regulatory obligations, and technology domains, and rationalizes control inventories to improve consistency across platforms and shared services. The position maps controls to risks, policies, standards, obligations, important services, and accountable owners. It governs exceptions to cyber standards and control requirements, partners with control owners and technology stakeholders to embed requirements earlier in delivery and engineering lifecycles, and supports alignment across identity, infrastructure, application security, third-party risk, and resilience. The role also defines control objectives and design expectations, improves control-health reporting, drives policy refresh cycles, contributes to AI and emerging-technology governance, and supports workflow, data-quality, and automated-evidence improvements.

Requirements

Bachelor's degree in computer science or a related discipline, or equivalent work experience; a bachelor's degree or equivalent experience in cybersecurity, information security, risk management, technology, or a related discipline is also specified.
15+ years of experience in information security or related technology experience.
Significant experience in Cyber GRC, technology risk, control framework management, cyber policy, or related governance functions.
Strong understanding of cybersecurity control domains, including identity, infrastructure, application security, vulnerability management, resilience, and third-party risk.
Experience designing or managing policy hierarchies, standards frameworks, and control inventories in a complex enterprise environment.
Knowledge of risk and control mapping, control rationalization, and governance processes.
Ability to translate regulatory, audit, and operational requirements into practical control requirements.
Strong written communication and stakeholder management skills.

Nice To Haves

Advanced degree preferred.
Experience in the securities or financial services industry is a plus.

Responsibilities

Lead development, maintenance, and modernization of cyber governance frameworks, policies, standards, and control principles.
Define and maintain a common cyber control taxonomy and control framework aligned to enterprise risk, regulatory obligations, and technology domains.
Rationalize control inventories to reduce duplication, remove ambiguity, and improve consistency across platforms and shared services.
Map controls to risks, policy requirements, standards, obligations, important services, and accountable owners.
Establish and govern exception processes for cyber standards and control requirements, including review, challenge, documentation, and escalation.
Partner with control owners and technology stakeholders to embed policy and control requirements earlier in the change, engineering, and delivery lifecycle.
Support control framework alignment across identity, infrastructure, application security, third-party risk, and resilience.
Define control objectives, minimum requirements, and design expectations to support consistent assessment and testing outcomes.
Collaborate with governance and reporting teams to improve management transparency and control-health reporting.
Drive policy refresh cycles based on threat changes, regulatory developments, audit feedback, and strategic transformation priorities.
Contribute to integrating AI and emerging-technology governance requirements into the broader cyber control architecture.
Support target-state enablement through improved workflow, data quality, and automated evidence opportunities.