Senior Director, Information Security Manager at BNY

New York, New York, United States -

Full Time

Start Date

Immediate

Expiry Date

11 Feb, 26

Salary

0.0

Posted On

13 Nov, 25

Experience

10 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Information Security, Penetration Testing, Red Team Operations, Audit Management, Regulatory Compliance, Cloud Security, Offensive Security, Risk Management, Team Leadership, Documentation, Metrics Development, Data Security, Identity and Access Management, DevSecOps, Governance, Incident Response

Industry

Financial Services

Description

Ensure high standards for methodology, reporting quality, reproducibility, and remediation guidance. Implement robust metrics, dashboards, and OKRs that show coverage, risk reduction, and time‑to‑remediate Audit and regulatory exam outcomes (on‑time, no/low‑severity issues, rapid issue closure). Establish scalable catalog services, rate cards, and standard scoping templates to improve predictability and throughput. Govern end‑to‑end regulatory assessment obligations (e.g., SOX, GLBA, GDPR/CCPA, NYDFS, ISO/IEC 27001, MAS TRM), ensuring scope alignment, evidence lifecycle management, and audit readiness. Maintain policy, standards, and playbooks for penetration testing and red team operations mapped to NIST SP 800‑115, PTES, OWASP ASVS/MASVS, MITRE ATT&CK/D3FEND. Recruit, develop, and retain top talent across pen test, red team, cloud/offensive engineering, and program management disciplines. Build a high‑performance culture with clear career paths, mentoring, and communities of practice. 15+ years of progressive experience in Information Security or related fields, including a specialization in offensive security (penetration testing, ethical hacking, red team/adversary emulation). 7+ years leading large, multi-regional teams (direct leadership of managers and senior ICs). 5+ years owning audit-facing or regulator-facing security programs, including evidence management and exam coordination. Evidence lifecycle governance (from scoping approvals to final reports and remediation validation) with strong documentation and version control. RASCI models, QA/QC gates, and repeatable playbooks to ensure consistent, audit‑ready outcomes. Experience in highly regulated industries (e.g., financial services, healthcare, critical infrastructure, technology/SaaS). Experience with cloud, containers/Kubernetes, network segmentation, microservices, and modern SDLC/DevSecOps patterns. Familiarity with identity and access attacks (SSO/OAuth/OIDC), data security, SaaS attack surfaces, and supply‑chain testing. Hands‑on understanding of offensive tooling and frameworks, with rigorous safety and legal controls.

How To Apply:

Incase you would like to apply to this job directly from the source, please click here

Responsibilities

Ensure high standards for methodology, reporting quality, and remediation guidance while governing regulatory assessment obligations. Recruit and develop top talent while building a high-performance culture with clear career paths.