Information Security Officer

Job Description: Vice President – SSBI Information Security Officer

The Information Security Officer will drive compliance with global cybersecurity controls in their business unit/region/country/functional area which they represent. The ISO will serve as a trusted advisor to mid and senior-level business management within State Street Bank International.

ISO roles and responsibilities are defined under multiple domain areas, such as Information Security and Risk Management, Cyber Incident and Response Management, Cyber Controls Analysis, and Cyber Reporting.

We are searching for a strong cyber controls analyzer with experience in identifying cyber risk aligned to business functions. The VP, Information Security Officer will lead our Protection Needs Analysis program within State Street Bank International. This candidate should be able to correlate our cyber risk taxonomy aligned to applicable business processes to conclude on the residual cyber risks aligned to the business functions and critical business services.

Responsibilities

1. Implement and maintain information security risk assessment processes and procedures in accordance with regulatory requirements (ECB, BAIT, DORA, etc.)
2. Collaborate with key stakeholders to identify information assets and assess the protection needs requirements for the entire line of business and legal entity.
3. Manage and monitor the completion of protection needs analysis in State Street Bank International, including coordinating resources, managing escalation, and preparing reports.
4. Establish and maintain sustainable yet continuous improvement practices for the protection needs analysis function.
5. Participate in cyber risk forums and committees with other stakeholders including Executive Management, Internal Audit, Enterprise Technology Risk Management, Compliance, Legal, and Regulatory.
6. Present to mid to senior level executive leadership on protection needs outcomes and controls, requiring experience presenting at all organizational levels and preparing executive communications.
7. Possess the technical experience to assist in solving challenging cyber issues aligned to evolving regulations while building strong working relationships globally.
8. Integrate information security risk review into lifecycle processes such as Incident Management, Vulnerability Management, Third-Party Risk Review, Cyber Resiliency, eSDLC, Change and Project management.
9. Understand the context of the business unit, including internal and external issues, organizational structure, organizational drivers, geography, strategy, and legal and regulatory requirements.
10. Report significant changes in information security risk to the appropriate management level for review on a periodic and event-driven basis.
11. Assess information security risk associated with high risk/critical business processes and technology and apply information security supplemental requirements to mitigate risk.

ISO Competencies and Qualifications

The Information Security Officer should possess the following skills/experience:

1. Successfully completed bachelor’s degree or equivalent work experience.
2. CISSP or CISM required.
3. CRISC, CISA, SSCP or similar certification a plus.
4. Experience working with the NIST Cybersecurity Framework.
5. Qualitative cybersecurity risk analysis experience highly preferred.
6. 8 years of information security experience in an operational or analytical capacity.
7. Financial services experience in a regulated environment highly preferred.
8. Experience with business concepts including financial, business requirements, compliance, and risk management.
9. Experience with European Central Bank (ECB) ICT guidelines and BAIT (Bankaufsichtliche Anforderungen an die IT) guidelines.
10. Strong analytical, communication, research, and organizational skills.
11. Strong interpersonal skills such as active listening, dependability, and teamwork are critical.

#J-18808-Ljbffr