Senior Director, Business Information Security Officer (BISO)

We’re seeking a future team member for the role of Senior Director, Business Information Security Officer (BISO) to join our Cyber Security Team. This role can be located in New York City or Washington DC.
 

The Business Information Security Officer (BISO) is the senior security leader aligned to a platform and is responsible for embedding cyber security, cyber risk management, resilience and regulatory readiness into platform strategy, operations and change delivery. The role serves as a trusted partner to platform leadership and provides senior oversight and direction on security posture, control priorities, secure transformation and cyber risk decision-making. The BISO enables the platform to move at pace while maintaining strong risk discipline, protecting clients, data, services and the firm’s reputation.
Reporting to the International CISO, this individual will operate as an embedded senior officer with strong influence across platform leadership, engineering, architecture, operations, legal, risk, compliance, audit and client-facing teams. The role requires deep cyber security expertise, excellent communication skills, strategic thinking and the ability to engage credibly with senior internal stakeholders and clients.
 

In this role, you’ll make an impact in the following ways:
•    Act as the senior cyber security lead for an assigned platform, aligning security priorities to platform objectives, risk profile, regulatory obligations and strategic plans.
•    Serve as the primary security advisor to platform leadership, providing clear guidance on cyber threats, control effectiveness, resilience priorities and risk posture.
•    Own and maintain the platform cyber risk register, ensuring material risks, control gaps and vulnerability themes are identified, assessed, prioritized and actively managed.
•    Drive remediation of high-priority cyber risks and issues in partnership with technology, engineering, architecture and operational stakeholders.
•    Translate technical findings, threat intelligence, vulnerabilities and control concerns into concise business impact statements and actionable decisions for senior leaders.
•    Partner with security architecture and cyber engineering teams to ensure products, services, technology changes and transformation initiatives are secure by design.
•    Engage early in platform strategy, change and delivery forums so that cyber security requirements are addressed proactively and do not emerge as late-stage blockers.
•    Provide leadership during cyber incidents affecting the platform, supporting decision-making, impact assessment, communications and coordination with response teams.
•    Act as a senior point of contact for cyber-related audits, regulatory examinations, client security reviews and internal control assessments.
•    Oversee preparation of evidence, management responses and remediation activities related to security findings, control issues and regulatory expectations.
•    Establish a regular cadence of cyber health reporting, risk reviews and executive updates for platform leadership and the International CISO.
•    Influence risk acceptance, exception handling and remediation planning through sound judgment, strong challenge and pragmatic problem solving.
•    Build trusted relationships across platform leadership, technology, operations and control functions and represent security with credibility, clarity and commercial awareness.
•    Engage with clients as required on cyber security posture, control environment, resilience capabilities and risk management practices.
•    Promote a culture in which cyber security is understood as a business enabler that supports safe growth, innovation, operational resilience and client trust.
 

To be successful in this role, we’re seeking the following:
•    Bachelor's degree in computer science or a related discipline, or equivalent work experience required, advanced degree preferred. 15+ years of experience in information security or related technology experience required, experience in the securities or financial services industry is a plus
•    Significant senior experience in cyber security, information security and cyber risk management within a complex, highly regulated environment.
•    Deep knowledge of cyber threats, security controls, vulnerability management, identity and access management, incident response, security architecture and resilience.
•    Strong understanding of cyber risk governance, regulatory expectations, audit engagement and issue management in financial services or similarly demanding sectors.
•    Demonstrated ability to engage and influence senior executives, engineering leaders, control functions and external stakeholders on complex security matters.
•    Proven ability to translate technical cyber issues into commercially relevant business impact, strategic options and risk-based recommendations.
•    Experience supporting or leading client-facing discussions on security posture, controls, assurance and resilience is highly desirable.
•    Excellent written and verbal communication skills, with strong executive presence and the ability to operate effectively across complex stakeholder environments.
•    Strong strategic thinking, sound judgment, high personal credibility and the ability to lead through influence in a fast-paced environment.
Leadership Profile
•    Highly credible cyber security leader with strong technical depth and risk judgment.
•    Strategic thinker who can connect security priorities to platform outcomes and enterprise objectives.
•    Exceptional communicator and influencer who can simplify complexity and drive clarity in executive decision-making.
•    Trusted advisor who can challenge constructively, build alignment and foster strong partnerships across diverse stakeholders.
•    Pragmatic and delivery-oriented leader who balances risk discipline with business enablement.
•    Role model for accountability, collaboration, integrity and high standards.