Vice President, Cyber Exercises & Threat Simulation

BNY Mellon•New York, NY

12d•Onsite

About The Position

BNY is seeking a Vice President, Cyber Exercises & Threat Simulation to join its global Cyber Threat Simulation team in New York, NY. This individual-contributor position has no direct reports and reports to the Head of Cyber Threat Simulations. The role spans cyber war games and the phishing program, with responsibilities shaped by the employee’s skills and experience and the needs of the global team. The employee will own assigned activities, contribute to larger exercises, and work with colleagues across regions and with Cybersecurity, business and technology teams, Enterprise Resilience, and Communications. The role involves developing realistic cyber exercise scenarios and facilitating exercises with technical and business participants, then turning observations into practical improvements. It also includes designing and operating quarterly global phishing tests and targeted spear-phishing simulations, and managing education and remediation workflows. The successful candidate will help evolve the team’s use of AI tools and automation to improve simulation realism, analysis, and delivery while validating outputs and protecting sensitive information.

Requirements

Experience delivering cyber exercises, phishing simulations, incident response, operational resilience, or closely related work, with evidence of translating complex risks into realistic scenarios or practical improvements.
Ability to plan and coordinate activities from initial requirements through delivery, manage stakeholders, and balance competing priorities.
Understanding of cyber threats, incident response, phishing, and social engineering, and how cyber incidents can affect business services and clients.
Strong communication and facilitation skills, including the ability to engage technical and business audiences, ask effective questions, and produce clear briefings and reports.
Ability to analyze data and observations, check the evidence behind findings, and develop actionable recommendations.
Practical ability to use AI tools through effective prompting, iterative refinement, and validation, with sound judgment about accuracy, confidentiality, and human oversight.
Bachelor’s degree in Cybersecurity, Information Security, Information Technology, or a related discipline, or equivalent practical experience.

Nice To Haves

Experience designing and facilitating cyber war games or tabletop exercises, particularly with senior leaders or external clients.
Experience delivering phishing campaigns and using simulation platforms or security awareness tools.
Experience working across regions or within a complex, regulated organization, with an understanding of financial services or operational resilience.
Experience applying generative AI, automation, dashboards, or analytics to improve cybersecurity workflows, with examples of benefits achieved and how outputs were validated.
Familiarity with structured exercise planning and evaluation methods.
Relevant security or risk certifications, such as CISSP, GIAC, or SANS, are welcome but not required.
Relevant experience may come from financial services, consulting, other industries, or military and government roles.

Responsibilities

Own assigned war games and tabletop exercises from objective setting and stakeholder planning through scenario development, delivery, and debrief.
Create realistic scenarios, injects, participant briefings, and facilitator materials informed by threat intelligence, emerging attacker techniques, business dependencies, and AI-enabled threats.
Facilitate exercises with technical and business participants, drawing out assumptions, decision challenges, and opportunities to improve response and recovery.
Support larger enterprise, executive, and client exercises through planning, stakeholder coordination, scenario development, and observation capture.
Analyze exercise observations and produce concise debriefs and reports with actionable recommendations.
Work with stakeholders to agree improvement actions and support follow-up where required.
Design, build, and execute quarterly global phishing tests for employees, contractors, and consultants, alongside targeted spear-phishing simulations informed by role, access, threat intelligence, and prior susceptibility.
Operate phishing education and remediation workflows, including repeat-susceptibility tracking and escalation, and partner with Cyber Awareness, Learning, and Communications to target support.
Analyze phishing results and exercise findings to identify risk patterns, communicate insights, and recommend practical interventions for technical and non-technical audiences.
Pilot AI tools and automation to develop scenario variants and simulated stakeholder dialogue, streamline campaign delivery, and accelerate analysis and reporting.
Validate AI and automation outputs, protect sensitive information, and measure improvements in quality and efficiency.
Maintain exercise and campaign documentation, operating procedures, and testing standards, and share effective approaches across the global team.