AVP, Information Security Strategy & Governance

Title: AVP, Information Security Strategy & Governance

Office Status: Hybrid New York, NY

Base Salary: $100k - $150k + discretionary bonus




Overview:

This is a well-established financial institution with a mature and growing information security program seeking a seasoned IT/IS risk and governance professional to serve as a key strategic partner to the CISO. The role sits at the intersection of governance, risk, compliance, and program management offering high visibility and meaningful impact across the organization's security posture. It's an excellent opportunity for a candidate who thrives in a structured, regulated environment and wants to own programs end-to-end rather than work in a narrow technical lane.




Key Responsibilities:

• Establish, maintain, and periodically refresh Information Security policies, procedures, and controls guidance across first and second lines of defense
• Coordinate Information Security strategy in alignment with broader organizational goals, maintaining KRIs and tracking strategic initiative execution through quarterly reviews
• Provide end-to-end project management for all CISO-led initiatives, including the Information Security Program and Training & Culture Program
• Develop and execute an annual IT/IS risk work plan covering risk identification, assessment, control evaluation, and testing activities
• Conduct risk assessments across projects, third-party engagements, new business activities, and application environments
• Catalog and oversee remediation of IT/IS issues arising from internal audits, regulatory examinations, root cause analyses, and control testing
• Prepare and manage audit evidence requests and develop a comprehensive, proactive approach to audit readiness across CISO policies and standards
• Prepare response evidence for IT/IS-related regulatory examinations and recommend policy or process changes to align with applicable federal guidelines and regulations
• Develop, monitor, and report on CISO metrics, KRIs, and policy adherence measures for senior leadership
• Liaise cross-functionally with Legal, Compliance, Risk, and Audit teams to ensure the CISO function meets all regulatory IT/IS requirements