Groupe BPCE
Information Security Officer – Deputy CISO
Groupe BPCE, New York, New York, us, 10261
Information Security Officer – Deputy CISO
CDIWORKDAY_JR00858New YorkThis role reports to the Chief Information Security Officer (CISO) for CIB Americas, who ensures that the bank adheres to global policies, procedures, standards, and directives as well as all U.S. regulatory requirements and is responsible for oversight of IT Security generally within the Americas region. This role includes responsibility for ensuring the confidentiality, integrity, and availability of information assets by identifying and assessing risks, identifying threats and vulnerabilities, and overseeing the implementation of appropriate controls to adequately mitigate risks.Key Responsibilities:Assist in managing the Second Line of Defense Cybersecurity and Information Security frameworks.Perform assessments of completeness and adequacy of the risks and controls supporting Information and Cybersecurity in the Americas Platform.Perform effective 2nd Line of Defense challenge of IT processes, controls, and other activities that define the full scope of Information and Cybersecurity risks.Recommend enhancements to the business processes and controls that contribute to the overall effectiveness of the 2nd Line of Defense Cybersecurity Program.Perform various risk assessment activities fundamental to an effective program, including overseeing penetration tests and maturity assessments.Ensure compliance with legal and regulatory requirements relating to cybersecurity, particularly the firm’s adherence to DFS NYCRR 23 Part 500, including the annual written CISO report to the Board and annual attestation of compliance.Assist in operationalizing the Monitoring and Threat Assessment Framework through monitoring of vulnerability indicators, heat maps, key risk and control indicators, and other measures of risk effectiveness.Perform oversight controls of the 1st line of defense to ensure continual effectiveness of IT risk management controls and compliance with Natixis Information Security Policies and Standards.Provide monthly reporting and program updates to Senior management and the Americas Technology Risk Management Committee.Monitor applications, systems, and networks to ensure compliance with security policies, practices, and procedures.Lead information security awareness training and educational activities, including conducting phishing campaigns and senior management awareness training.Provide support to the Data risk and Privacy programs through the introduction of industry best practices and alignment of information security controls with privacy regulations.Assist in managing the Information Security residual risk exposure from third-party vendor and affiliate activities.Participate and provide subject matter expertise in Cyber incident response and recovery activities.The salary range for this position will be between $175,000 - $225,000. Natixis is required by law to include a reasonable estimate of the compensation range for this role. Actual base salary will vary based on several factors including, but not limited to, relevant experience, education, skills set, applicable licensure and certifications, and other business and organizational needs. Base salary is only one component of our total rewards package. Natixis also offers a generous benefits package, and you may be eligible for a discretionary incentive award depending on company and individual performance.Minimum Requirements:B.S./M.S. degree in Computer Science, Information Security, or a related technical field.10+ years of experience in information security and/or IT Security in a banking environment.Good understanding of information security risk through knowledge of IT processes and controls.Experience performing IT risk assessments is preferred.Strong experience in creation and maintenance of policies and procedures.Effective communication and interpersonal skills to collaborate with teams in multiple geographical locations and diverse cultural environments.Experience leveraging IT risk frameworks such as ISO27001, NIST CSF, COBIT, COSO.Hands-on experience with GRC tools (e.g. Archer).CISM/CISSP/CRISC certification (preferred).
#J-18808-Ljbffr
CDIWORKDAY_JR00858New YorkThis role reports to the Chief Information Security Officer (CISO) for CIB Americas, who ensures that the bank adheres to global policies, procedures, standards, and directives as well as all U.S. regulatory requirements and is responsible for oversight of IT Security generally within the Americas region. This role includes responsibility for ensuring the confidentiality, integrity, and availability of information assets by identifying and assessing risks, identifying threats and vulnerabilities, and overseeing the implementation of appropriate controls to adequately mitigate risks.Key Responsibilities:Assist in managing the Second Line of Defense Cybersecurity and Information Security frameworks.Perform assessments of completeness and adequacy of the risks and controls supporting Information and Cybersecurity in the Americas Platform.Perform effective 2nd Line of Defense challenge of IT processes, controls, and other activities that define the full scope of Information and Cybersecurity risks.Recommend enhancements to the business processes and controls that contribute to the overall effectiveness of the 2nd Line of Defense Cybersecurity Program.Perform various risk assessment activities fundamental to an effective program, including overseeing penetration tests and maturity assessments.Ensure compliance with legal and regulatory requirements relating to cybersecurity, particularly the firm’s adherence to DFS NYCRR 23 Part 500, including the annual written CISO report to the Board and annual attestation of compliance.Assist in operationalizing the Monitoring and Threat Assessment Framework through monitoring of vulnerability indicators, heat maps, key risk and control indicators, and other measures of risk effectiveness.Perform oversight controls of the 1st line of defense to ensure continual effectiveness of IT risk management controls and compliance with Natixis Information Security Policies and Standards.Provide monthly reporting and program updates to Senior management and the Americas Technology Risk Management Committee.Monitor applications, systems, and networks to ensure compliance with security policies, practices, and procedures.Lead information security awareness training and educational activities, including conducting phishing campaigns and senior management awareness training.Provide support to the Data risk and Privacy programs through the introduction of industry best practices and alignment of information security controls with privacy regulations.Assist in managing the Information Security residual risk exposure from third-party vendor and affiliate activities.Participate and provide subject matter expertise in Cyber incident response and recovery activities.The salary range for this position will be between $175,000 - $225,000. Natixis is required by law to include a reasonable estimate of the compensation range for this role. Actual base salary will vary based on several factors including, but not limited to, relevant experience, education, skills set, applicable licensure and certifications, and other business and organizational needs. Base salary is only one component of our total rewards package. Natixis also offers a generous benefits package, and you may be eligible for a discretionary incentive award depending on company and individual performance.Minimum Requirements:B.S./M.S. degree in Computer Science, Information Security, or a related technical field.10+ years of experience in information security and/or IT Security in a banking environment.Good understanding of information security risk through knowledge of IT processes and controls.Experience performing IT risk assessments is preferred.Strong experience in creation and maintenance of policies and procedures.Effective communication and interpersonal skills to collaborate with teams in multiple geographical locations and diverse cultural environments.Experience leveraging IT risk frameworks such as ISO27001, NIST CSF, COBIT, COSO.Hands-on experience with GRC tools (e.g. Archer).CISM/CISSP/CRISC certification (preferred).
#J-18808-Ljbffr