Country Information Security Officer

at  Bank of America

JOB DESCRIPTION:

At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. Responsible Growth is how we run our company and how we deliver for our clients, teammates, communities and shareholders every day.
One of the keys to driving Responsible Growth is being a great place to work for our teammates around the world. We’re devoted to being a diverse and inclusive workplace for everyone. We hire individuals with a broad range of backgrounds and experiences and invest heavily in our teammates and their families by offering competitive benefits to support their physical, emotional, and financial well-being.
Bank of America believes both in the importance of working together and offering flexibility to our employees. We use a multi-faceted approach for flexibility, depending on the various roles in our organization.
Working at Bank of America will give you a great career with opportunities to learn, grow and make an impact, along with the power to make a difference. Join us!

JOB DESCRIPTION

This job is responsible for partnering with leaders to balance the needs of the business while ensuring information security and organizational risks are appropriately identified and managed to drive uncompromising cyber security protection. Key responsibilities include leading in-depth information security risk-based discussions and acting as an integrated business partner with cross-functional leaders to provide blended security and business expertise while ensuring to ensure appropriate management of information security risks.
We are seeking a highly skilled Senior Information Security Officer to oversee and safeguard our information assets within Canada primarily, but also able to operate as a team member supporting other countries in LATAM region or within the GIS (Global Information Security) International team.
This role requires a dynamic professional who can seamlessly transition between hands-on technical / non-technical tasks and high-level strategic responsibilities. Reporting to the LATAM & Canada Regional Information Security Officer, the successful candidate will play a pivotal role in developing and implementing robust security strategies tailored to the local landscape.

REQUIRED SKILLS:

• Information Security & Technology / Risk Management professional with 10+ years’ experience.
• In-depth knowledge of security frameworks, risk management, and compliance requirements.
• Deep knowledge on local information and cybersecurity regulatory requirements and experience on implementation.
• Subject matter expertise in application security, vulnerability testing and development of risk management.
• Experience evaluating cyber security controls and providing guidance for platform or distributed computing platforms (e.g. Cloud, PaaS).
• Knowledge in Windows, Unix, Midrange and Mainframe Platforms with emphasis on security and access controls.
• Exceptional executive presentation and communication skills.
• Ability on producing operational, tactical, and executive presentations and reporting, including KRIs.
• Excellent influencing and problem resolution skills.
• Ability to be comfortable delivering messages across a wide spectrum of individuals having varying degrees of technical understanding.
• Strong leadership including soft skills which enable you to work and build relationships in a diverse and multi-cultural environment with global, regional, and local peers, supporting Lines of Business and various levels of management.
• Capacity to work on hands on operational, tactical, and executive topics simultaneously, for the country and as a supporter for the LATAM region.
• Organization, high accountability and discipline to work with little supervision.

DESIRED SKILLS:

• Bachelor’s and/or master’s degree in computer science, Information Technology, or related field desired
• Highly desirable: accredited Information Security certification(s) such as CISSP, CISM, CRISC, CISA.
• Spanish and/or Portuguese desirable for regional work.

• Possess strong / experienced application development and/or application security background; with solid knowledge of SDLC from design, testing, deployment to post-production and the different risk elements associated with each step.
• Serves as an Information Security subject matter expert and participates in the development, implementation and maintenance of information security for the line of business (LOB).
• Collaborate with regional leadership to align security initiatives with overall business objectives.
• Advises LOB (Line of Business) management on risk issues related to information security and recommends actions in support of the bank’s wider risk management and compliance programs.
• Able to translate high-level business goals into actionable security strategies for the country.
• Stay abreast of emerging threats and technologies, applying practical solutions to address security challenges in line with local and global standards and expectations.
• Supports internal, external, and regulatory audit-related deliverables and action plans.
• Close tracking on Enhanced Remediation Program (ERP) efforts.
• Support leading the regional awareness program according to local needs.
• Provides key local support on Identity and Access Management end-to-end process, including actively action whenever needed.
• Works on local regulatory requirements, including review and implementation as part of business as usual operation.
• Manages quality control and reporting.
• Ensures compliance with applicable policies and laws.
• Drives GIS/Line of Business risk deliverables.
• Collaborates with risk partners on info security critical priorities.
• Participates in senior LOB specific Risk Management & Business Continuity Routines.
• Foster a culture of security awareness through training programs and communication strategies.
• Collaborate with internal stakeholders to integrate security practices into business processes.
• Identifies and measures Global Information Security (GIS) controls on most critical business processes or channels.
• Supports the triage process with the client and helps them understand the GIS support structure.
• Drives required risk culture and partnership with peer technology teams and supported LOB.
• Participates in key CIO operating routines to drive information security risk strategy.
• Interfaces with global programs like Third-Party Information Security Assessment (TPIS), ADSF (Ethical Hacking), etc. to support local / regional initiatives.