VP- Technology Information Risk Management - NYC /Florham Park, NJ

VP- Technology Information Risk Management

Location: Ideal 2-3 days Hybrid in NYC office

Duration: Full Time

Location Options: Open to a combo of Melville, NY (Long Island) with one day in NYC (initial training in NYC)

Open to a combo of Florham Park, NJ with one day in NYC (initial training in NYC)

Functional Summary: Information Risk Management is a 2nd Line oversight function. At BSNY/SANCAP, the Information Risk Management (IRM) team engages in key projects and business/technology initiatives, works with the 1st and 3rd Lines to drive a business aligned, risk-based, cost-effective program designed for the confidentiality, integrity and availability of information, information systems (technology infrastructure, application systems and end-user technology) and information resources in support of business products and processes.

Position Summary

Client is looking to hire an Information Risk Management VP to become a key member of our Information Risk Management team. We are looking for an experienced candidate with a solid Information Technology risk or audit background and experience in operational risk and managing information technology, information security or similarly complex programs in the Financial Services industry. The candidate will be part of the 2nd line of defense Information Risk Management team responsible for managing risk frameworks and policy, and providing oversight, review and credible challenge of risk management activities. This role will report to the Head of Information Risk Management. The individual will partner with key stakeholders across all lines of defense, all business lines and support functions, including IT, IS, Risk, Compliance, Legal, Audit, Human Resources and Finance, to support the identification, assessment, management and reporting of information risks. The individual will work in concert with the operational risk management team, including the vendor risk management and business continuity management teams, to ensure close coordination, integration, transparency and awareness of information risks across all risk management programs.

Primary Responsibilities

Provides 2nd Line risk oversight of the Information Risk Management Program and provides direct 2nd Line support for the Information Technology, Information Security, Business Continuity Management and Records Management Programs, including policies/standards/procedures, strategies, material risks, risk reporting routines and metrics. Independently serves as a trusted partner and risk advisor to key stakeholders and business partners across all lines of defense. Credible review and challenge of 1st Line Risk and Control Self-Assessments, including process mapping, identification and assessment of risk, identification of controls, and assessments of control design and effectiveness. Provide direct support for regulatory exams and interactions, including assessing risk remediation activities. Perform independent risk assessments of information risk management related disciplines, including information technology, information security, business continuity management and disaster recovery and records management. Positively contribute to the risk culture and overall awareness of information risk and contribute to the creation and delivery of information risk management training. Escalate, report and communicate information risk management matters to executive management and/or regulatory bodies.

Experience & Qualifications

8+ years of related experience; ideally a combination of Technology Risk (1st or 2nd line), IT Audit (3rd line) and/or 1st line Information Technology or Information Security experience. Experience in Banking / Financial Services/Insurance. Bachelor's degree in the field of IT, Information Security or related field; Master's degree preferred. Must actively hold one or more recognized industry certifications (CISA, CISM, CRISC, etc.) Thought leader, strategic and critical thinker, problem solver. Ability to work well both independently and collaboratively as a member of the team. Ability to multi-task, work in a fast-paced environment and adapt to change. Ability to influence with strong written and verbal communication skills. Integrity, combined with high personal and professional standards. Strong program and project management skills/capabilities

Specialized Knowledge

Risk Management Processes: Risk Identification, Risk Assessment, Risk Treatment Measures including Risk Acceptance, Governance including Measuring/Monitoring/Reporting, Risk Aggregation, Control Assessments & Controls Testing, RCSA, etc. Information Technology Processes: asset management, change management, incident/problem management, patch management, Software Development Lifecycle (SDLC), release management, capacity/performance management, data/records management and destruction, backup and recovery, etc. Information Security Processes: Identity and access management, privileged access management, generic ID management, threat intelligence, vulnerability management, secure coding practices, data security and encryption, phishing, forensics, mobile security, third-party, etc. Business Continuity Management including Business Impact Analysis and Disaster Recovery Planning. Technical skills and capabilities (general understanding and/or working knowledge of several of the below examples is a minimum requirement): Microsoft Windows Server/Desktop, Red Hat Linux, IBM AIX, IBM Mainframe/Midrange, VMWare ESXi, LAN/WAN/MAN Networking, Firewall Technologies, Intrusion Detection/Prevention Systems (IDP/IPS), Security Information and Event Management (SIEM), Cloud Computing, Governance Risk and Compliance (GRC) Tools, Web Proxies, SQL/Oracle/DB2 Database Technologies, Data Leakage Protection (DLP), Storage Area Networks (SAN) and Network Attached Storage (NAS), Email Systems, Web Servers, Middleware Technologies, Microsoft SharePoint. Data Analysis skills in Excel, with visualization skills in PowerBI or Tableau a plus Regulatory Knowledge: Gramm-Leach Bliley Act (GLBA), Sarbanes-Oxley (SOX), OCC Heightened Standards, FFIEC Guidelines, Health Insurance Portability and Accountability Act (HIPAA), New York Department of Financial Services (NYDFS) Cybersecurity Regulation, EU General Data Protection Regulation (GDPR). Knowledge of Industry-Standard Frameworks: NIST Cybersecurity Framework, SAN/CIS Critical Security Controls, ISO 9001/20000/22301/27001/31000, ISACA COBIT, COSO 2013.