Controls)

BNY Mellon•New York, NY

15d•$136,500 - $350,000•Onsite

About The Position

BNY is seeking a Senior Director to join its CyberSecurity team in New York. The role focuses on cyber governance, risk, and compliance frameworks, policies, and controls. The successful candidate will lead the development and modernization of cyber governance materials and control principles, align controls with enterprise risks and regulatory obligations, and improve consistency across platforms and shared services. The role also involves working with control owners and technology stakeholders to embed requirements into delivery processes, supporting key cybersecurity domains, improving control reporting and evidence workflows, refreshing policies, and integrating AI and emerging technology governance requirements.

Requirements

Bachelor's degree in computer science or a related discipline, or equivalent work experience; an advanced degree is preferred.
15+ years of experience in information security or related technology experience.
Significant experience in Cyber GRC, technology risk, control framework management, cyber policy, or related governance functions.
Strong understanding of cybersecurity control domains, including identity, infrastructure, application security, vulnerability management, resilience, and third-party risk.
Experience designing or managing policy hierarchies, standards frameworks, and control inventories in a complex enterprise environment.
Knowledge of risk and control mapping, control rationalization, and governance processes.
Ability to translate regulatory, audit, and operational requirements into practical control requirements.
Strong written communication and stakeholder management skills.

Nice To Haves

Experience in the securities or financial services industry.
An advanced degree.

Responsibilities

Lead the development, maintenance, and modernization of cyber governance frameworks, policies, standards, and control principles.
Define and maintain a common cyber control taxonomy and framework aligned with enterprise risk, regulatory obligations, and technology domains.
Rationalize control inventories to reduce duplication, remove ambiguity, and improve consistency across platforms and shared services.
Map controls to risks, policy requirements, standards, obligations, important services, and accountable owners.
Establish and govern exception processes for cyber standards and control requirements, including review, challenge, documentation, and escalation.
Partner with control owners and technology stakeholders to embed policy and control requirements earlier in change, engineering, and delivery lifecycles.
Support control framework alignment across identity, infrastructure, application security, third-party risk, and resilience.
Define control objectives, minimum requirements, and design expectations to support consistent assessment and testing outcomes.
Collaborate with governance and reporting teams to improve management transparency and control health reporting.
Drive policy refresh cycles based on threat changes, regulatory developments, audit feedback, and strategic transformation priorities.
Contribute to integrating AI and emerging technology governance requirements into the broader cyber control architecture.
Support target-state enablement through improved workflow, data quality, and automated evidence opportunities.

Benefits

Competitive compensation.
Wellbeing programs.
Paid leaves, including paid volunteer time.
401(k) plan for eligible employees.
Medical insurance for eligible employees and their eligible dependents.
Dental insurance for eligible employees and their eligible dependents.
Vision insurance for eligible employees and their eligible dependents.
Basic life insurance for eligible employees and their eligible dependents.
Other paid time off benefits, such as vacation and sick time, depending on the position offered.
Potential eligibility for an annual discretionary incentive award.