Chief Information Security Officer

The Chief Information Security Officer (CISO) provides vision, leadership, and strategic direction for BPM's enterprise information security, cyber risk, privacy, and trust programs. The CISO partners closely with the CIO and technology organization while maintaining independent responsibility for information security risk, governance, compliance, and assurance across the firm. The role partners with firm leadership, business units, legal, risk management, and technology teams to ensure security is integrated into business strategy, client service delivery, and emerging technologies, including artificial intelligence (AI). 

Strategy & Planning: 

• Participate as a member of the senior management team in governance processes of the organization’s security strategies. 

• Lead strategic security planning to achieve business goals by prioritizing defense initiatives and coordinating the evaluation, deployment, and management of current and future security technologies using a risk-based assessment methodology. 

• Develop and communicate security strategies and plans to executive team, staff, partners, customers, and stakeholders. 

• Assist with the design and implementation of disaster recovery and business continuity plans, procedures, audits, and enhancements. 

• Develop, implement, maintain, and oversee enforcement of policies, procedures, and associated plans for system security administration and user system access based on industry-standard best practices. 

Acquisition & Deployment: 

• Establish security architecture, governance, and risk management standards for the evaluation, acquisition, implementation, and operation of technology solutions across the firm.  

• Ensure security, privacy, compliance, and resiliency requirements are incorporated into the selection and deployment of enterprise applications, cloud services, infrastructure, and emerging technologies.  

• Provide security oversight and risk assessment for major technology initiatives, vendor relationships, and strategic business investments.  

• Define security requirements and approval processes for new technologies to ensure alignment with BPM's risk appetite, client commitments, and regulatory obligations. 

Operational Management: 

• Partner with technology leadership to ensure security, privacy, and risk management requirements are integrated into enterprise architecture, applications, infrastructure, and business processes.  

• Establish and oversee enterprise physical security, access control, and facility protection standards to safeguard BPM personnel, facilities, and information assets.  

• Develop and manage the information security operating and capital budgets.  

• Assess and advise on information security, privacy, and technology risks associated with strategic initiatives, technology investments, and third-party relationships.  

• Lead the development and performance of the information security team.  

• Develop and maintain strategic relationships with clients, regulators, vendors, and industry partners.  

• Advise executive leadership on cybersecurity, privacy, AI, and emerging technology risks and opportunities. 

Requirements/Qualifications: 

• Bachelor's degree in Computer Science, Information Security, Business Administration, or related field.  

• CISSP, CISM, CRISC, CCSP, or similar certifications preferred.  

• 10+ years leading information security and cyber risk programs.  

• Experience in professional services, public accounting, financial services, legal, healthcare, or other highly regulated industries preferred.  

• Deep knowledge of cybersecurity, risk management, cloud security, privacy, identity, and regulatory compliance.  

• Experience presenting to executive leadership and boards.