Senior Vice President, Information Security

BNY Mellon•Washington, WA

About The Position

The role is located in Washington, DC, within the Information Security Division – Business Information Security Office. The job description identifies the position as Senior Vice President, Information Security, while its description refers to a Senior Information Compliance Specialist. The role focuses on federal information security compliance, risk management, security control assessments, and Authority to Operate (ATO) processes. The successful candidate will maintain compliance with FedRAMP High requirements and applicable NIST and FISMA requirements, coordinate audits and their supporting evidence, and communicate ATO status, audit findings, remediation, and control gaps. The position also works with technical and non-technical partners to collect risk information and address issues, while helping reduce regulatory and reputational risks arising from non-compliance with information risk policies and standards.

Requirements

Bachelor’s degree in computer science or a related discipline, or equivalent work experience.
10+ years of experience in information security or related technology.
Demonstrated understanding of FISMA requirements and NIST special publications 800-53, 800-37, and 800-171.
Strong knowledge of the Risk Management Framework (RMF).
Proficiency in M365 applications.
Excellent decision-making skills, moral and ethical standards, teamwork and collaboration, multitasking, and attention to detail.
Exceptional organization and process management skills.

Nice To Haves

Advanced degree.
Experience in the securities or financial services industry.
Experience with federal compliance.
Demonstrated experience managing or executing successful ATO processes.
CISM, CISSP, or CISA security certification.

Responsibilities

Maintain a deep understanding of FedRAMP High, the NIST Risk Management Framework, and supporting legislation such as FISMA.
Develop and maintain security documentation required by FedRAMP, conducting frequent reviews and updates to ensure continued accuracy.
Ensure internal information risk management controls are effective and drive reviews of continued compliance with FedRAMP High requirements.
Lead Authority to Operate (ATO) processes for information systems.
Perform security control assessments, establish measures of control effectiveness, and recommend improvements.
Serve as the primary point of contact for inquiries about audits, security documentation, and control compliance.
Collaborate with technical and non-technical team members to address issues and collect relevant technical risk information.
Provide briefings on ATO status, audit findings and remediations, and current control gaps.
Help reduce regulatory and reputational risk caused by non-compliance with the Bank’s information risk management policies, standards, and applicable local procedures.
Identify and assess potential threats and vulnerabilities.
Prepare and coordinate audit evidence and respond to audit findings.