Group Chief Information Security Officer (New York)
Job Summary The Chief Information Security Officer (CISO) will lead and oversee the Information Security program across the entire organization. The role will be responsible for developing, implementing, and maintaining a unified enterprise security strategy that ensures the confidentiality, integrity, and availability of the company’s information assets, platforms, infrastructure, and customer data across all business operations. Location NY-New York (Union Square) Classification Full‑Time Benefits Employees scheduled to work less than 20 hours per week: Employee Discount, EAP and Sick Pay. Employees scheduled to work 20–29.99 hours per week: Employee Discount, EAP, Sick Pay, Paid Time Off including paid Maternity and Parental Leave, Company Paid Holidays, Transit and 401(k) with Company Match. Employees scheduled to work 30 hours or more: Employee Discount, EAP, Sick Pay, Paid Time Off including paid Maternity and Parental Leave, Company Paid Holidays, 401(k) with Company Match, Comprehensive Health Benefits (Medical, Dental and Vision), Healthcare and Dependent Care Spending Accounts, Healthcare Spending Account, Disability Benefits, Life Insurance, Transit, and Tuition Reimbursement. All benefits are provided in accordance with the current plan and may change. Benefits may vary by location/state regulations. An annual starting rate of $350,000–$400,000 is anticipated, depending on experience, seniority, and geographic location. What You Do Global Security Strategy Define and execute a unified cybersecurity strategy supporting the business objectives of both organizations. Lead the development and implementation of security policies, standards, and procedures aligned with regulations and best practices. Serve as a trusted advisor to executive leadership and the Board of Directors. Security Operations & Incident Response Leadership Lead the enterprise cybersecurity incident response and crisis management program. Act as primary technical contact with external crisis response agencies, cyber insurance providers, legal counsel, forensic investigators, regulators, and law enforcement. Drive continuous maturation of cyber resilience capabilities, including incident response planning, ransomware preparedness, disaster recovery, business continuity, tabletop exercises, and enterprise recovery strategies. Maintain enterprise‑wide incident response standards, escalation procedures, communication protocols, and post‑incident review processes. Direct 24/7 global security operations, including monitoring, detection, and response to security incidents. Technology & Infrastructure Security Leverage AI to improve detection, response, and scale. Ensure security is embedded in infrastructure, applications, cloud environments, and software platforms. Drive Zero Trust adoption, identity and access management, and secure data handling practices. Oversee regular penetration testing, vulnerability assessments, and third‑party risk management. Team Leadership & Development Lead and foster collaboration between security teams across both organizations. Recruit, mentor, and retain top cybersecurity talent. Direct work and ensure appropriate performance levels for all security team members. Partner with IT, Legal, Risk, HR, and other business units to ensure a holistic approach to Information Security. Executive Leadership & Cybersecurity Influence Serve as a visible and influential cybersecurity leader across both organizations. Champion a strong culture of security awareness at all levels. Act as the public and internal face of the cybersecurity function, communicating the organization’s security vision and maturity. AI‑Enhanced Cyber Defense & Governance Automate incident triage and response (SOAR AI). Enhance phishing and fraud detection using ML models. Collaborate with HR and Legal to define AI security policies and acceptable use standards. Classify and approve AI tools and vendors. Align with emerging regulatory frameworks such as the EU AI Act. Prevent data leakage into external AI platforms and enforce data classification and masking for AI use. Monitor environment for unauthorized use of enterprise data in AI tools. Preparation for and Defense Against AI‑generated phishing (highly personalized) Deepfake‑based social engineering Automated vulnerability discovery by attackers Knowledge & Experience Data Security & Protection Define and enforce enterprise data security standards, policies, and controls. Establish classification standards and ensure appropriate data handling, retention, archival, and disposal. Oversee encryption standards and key management practices. Implement access controls and privilege security models. Partner with Legal, Compliance, and technology teams to meet data privacy and regulatory requirements. Develop and maintain Data Loss Prevention strategies and monitoring capabilities. Support enterprise‑wide data handling and privacy training programs. Third‑Party & Supplier Risk Governance Establish a third‑party cybersecurity risk management program. Define governance standards and due diligence processes for vendor onboarding and contract reviews. Oversee continuous monitoring and risk evaluation of critical third‑party providers. Develop contingency strategies to mitigate operational, financial, and reputational risk. Regulatory & Audit Compliance Responsibilities Lead the information security compliance program across the organization. Ensure alignment with SOX, PCI‑DSS, GDPR, UK GDPR, CCPA, and other applicable regulations. Education & Professional Background Bachelor’s degree in Information Security, Computer Science, Engineering, or related field; advanced degree (e.g., MS in Cybersecurity) preferred. 15 years of experience in Information Security, with at least 7 years in a senior or executive leadership role overseeing enterprise‑scale security programs. Proven success leading global cybersecurity initiatives across multi‑national or multi‑brand organizations. Technical & Strategic Expertise Deep understanding of information security frameworks and architectures, including Zero Trust, cloud security, and identity management. Strong knowledge of regulatory requirements across U.S. and European jurisdictions. Demonstrated ability to balance security risk management with business enablement. Experience in incident response, crisis management, and executive‑level communications during security incidents. Leadership & Influence Recognized as a strategic cybersecurity leader who can inspire trust and confidence at all organizational levels. Strong executive presence with the ability to communicate complex technical concepts in clear, business‑relevant terms. Proven capability to build, mentor, and lead high‑performing security teams and encourage collaboration across geographies and business functions. Certifications (Preferred) CISSP, CISM, CISA, CRISC, CCISO, or equivalent industry‑recognized credentials. J-18808-Ljbffr
