Senior Director, Information Security Manager (Cyber GRC Controls Risk Management)

About the job

Senior Director, Information Security (Cyber GRC Controls Risk Management)

At BNY, our culture allows us to run our company better and enables employees’ growth and success. As a leading global financial services company at the heart of the global financial system, we influence nearly 20% of the world’s investible assets. Every day, our teams harness cutting-edge AI and breakthrough technologies to collaborate with clients, driving transformative solutions that redefine industries and uplift communities worldwide.

Recognized as a top destination for innovators, BNY is where bold ideas meet advanced technology and exceptional talent. Together, we power the future of finance – and this is what #LifeAtBNY is all about. Join us and be part of something extraordinary.

We’re seeking a future team member for the role of Senior Director, Information Security (Cyber GRC Controls Risk Management) to join our CyberSecurity team. This role is located in New York City.

In this role, you’ll make an impact in the following ways:

• Perform cyber and technology risk oversight across control domains, including identification of emerging, material, and systemic risk themes.
• Assess control effectiveness and risk exposure through review of control performance, deficiencies, monitoring outputs, and remediation status.
• Govern issue management processes from identification through closure, including challenge, escalation, validation, and aging oversight.
• Produce aggregated risk views, thematic analysis, KRI reporting, and governance materials for senior management and oversight forums.
• Monitor trends in control deficiencies, recurring issues, exception aging, unresolved exposures, and out-of-tolerance conditions.
• Partner with cyber continuous monitoring teams to leverage objective signals and automated evidence across identity, cloud, endpoint, network, secure configuration, and vulnerability domains.
• Support governance processes for high-priority remediation actions and critical control improvements.
• Provide challenge to Platforms and control owners on remediation quality, target dates, root causes, and residual risk positions.
• Help establish trigger-based governance routines driven by material risk movement, control drift, concentration risk, resilience gaps, and dependency concerns.
• Support coordination of issues arising from audits, incidents, self-identification, regulatory reviews, and control failures.
• Contribute to cross-Platform visibility into dependency risk, concentration exposure, important services, and resilience readiness.
• Support management reporting that is concise, decision-useful, and aligned to enterprise governance expectations.

To be successful in this role, we’re seeking the following:

• Bachelor's degree in computer science or a related discipline, or equivalent work experience required, advanced degree preferred. 15+ years of experience in information security or related technology experience required, experience in the securities or financial services industry is a plus..
• Bachelor’s degree or equivalent experience in Cybersecurity, Risk Management, Information Security, Technology, or related field.
• Significant experience in cyber risk management, control oversight, issue management, operational risk, or technology controls.
• Strong understanding of cyber control monitoring, issue remediation governance, and risk reporting practices.
• Experience analyzing control health, deficiencies, KRIs, exceptions, and remediation performance.
• Ability to independently challenge stakeholders and synthesize risk insights for management audiences.
• Strong analytical, governance, and problem-solving capabilities.
• Excellent communication skills with experience preparing senior-level reporting.

Preferred Qualifications:

• Experience in a large, global, regulated financial services environment.
• Familiarity with continuous control monitoring and automated evidence models.
• Understanding of operational resilience, third-party technology risk, and concentration risk.
• Knowledge of audit and regulatory response coordination.
• Relevant certifications such as CRISC, CISM, CISSP, CGEIT, or similar.

About Us

At BNY, our culture allows us to run our company better and enables employees’ growth and success. As a leading global financial services company at the heart of the global financial system, we influence nearly 20% of the world’s investible assets. Every day, our teams harness cutting-edge AI and breakthrough technologies to collaborate with clients, driving transformative solutions that redefine industries and uplift communities worldwide.

Recognized as a top destination for innovators, BNY is where bold ideas meet advanced technology and exceptional talent. Together, we power the future of finance – and this is what #LifeAtBNY is all about. Join us and be part of something extraordinary.At BNY, our culture speaks for itself, check out the latest BNY news at BNY Newsroom & BNY LinkedIn

Here’s a few of our recent awards:

• America’s Most Innovative Companies, Fortune, 2025

• World’s Most Admired Companies, Fortune 2025

• “Most Just Companies”, Just Capital and CNBC, 2025

Our Benefits and Rewards:

BNY offers highly competitive compensation, benefits, and wellbeing programs rooted in a strong culture of excellence and our pay-for-performance philosophy. We provide access to flexible global resources and tools for your life’s journey. Focus on your health, foster your personal resilience, and reach your financial goals as a valued member of our team, along with generous paid leaves, including paid volunteer time, that can support you and your family through moments that matter.

BNY is an Equal Employment Opportunity/Affirmative Action Employer - Underrepresented racial and ethnic groups/Females/Individuals with Disabilities/Protected Veterans.

BNY assesses market data to ensure a competitive compensation package for our employees. The expected base salary for this position when employment commences can be found in the Job Info section at the bottom of the posting.

Base salary offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. Base salary is only part of the total rewards package, which may include eligibility for an annual discretionary incentive award. Subject to the terms and conditions of the applicable plans then in effect, eligible employees may enroll in a 401(k) plan as well as participate in Company-sponsored medical, dental, vision, and basic life insurance plans for the employee and the employee’s eligible dependents. Eligible employees also may receive other benefits (including various paid time off benefits, such as vacation and sick time), dependent on the position offered. Details of participation in these benefit plans will be provided if an employee receives an offer of employment.

If hired, the employee will be in an “at will” position and the Company reserves the right to modify base salary (as well as any other discretionary payments or compensation programs) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors.

Additional Information

• Job Identification: 81549
• Job Category: Information Security
• Posting Date: 2026-11-13
• Job Schedule: Full time
• Locations: 240 Greenwich Street, New York, NY, 10286, US ()
• Base Salary Min: 136500
• Base Salary Max: 350000