- Company Name
- Madison-Davis, LLC
- Job Title
- Director, Information Security Risk Oversight & Advisory
- Job Description
-
**Job Title**
Director, Information Security Risk Oversight & Advisory
**Role Summary**
Act as the independent second‑line security risk function, evaluating and challenging enterprise‑wide information security risk assessments, controls, and remediation. Partner with senior risk, technology, and governance leaders to embed security risk into firm‑wide risk frameworks, influence operational risk practices, and provide strategic advisory on emerging threats and regulatory requirements.
**Expectations**
- Deliver unbiased, high‑level oversight of security risk initiatives across the organization.
- Influence risk appetite, policy, and architecture decisions through evidence‑based insights.
- Communicate findings, recommendations, and risk status to senior leadership, audit, and regulatory bodies.
- Ensure effective remediation, validation, and continuous improvement of security controls.
**Key Responsibilities**
- Review and challenge enterprise‑wide security risk assessments, control testing reports, and metrics.
- Serve as the primary second‑line risk advisor for cybersecurity, partnering with InfoSec and technology teams to enhance risk awareness and ownership.
- Evaluate the design and effectiveness of security controls, especially in complex or high‑risk technology programs.
- Prepare and present key risk oversight materials to leadership committees, internal audit, and regulators.
- Monitor findings, remediation progress, and validation efforts to guarantee closure and long‑term risk reduction.
- Assess project‑level security risk for initiatives, ensuring alignment with overall risk appetite and enterprise risk management (ERM) expectations.
- Integrate information security considerations into operational risk management frameworks and processes.
- Conduct root‑cause analysis of control failures or incidents and recommend actionable mitigations.
- Maintain governance documentation, including policies and procedures related to security oversight.
- Act as a strategic thought partner to senior leaders across technology, risk, and compliance, providing guidance on emerging threats and regulatory developments.
**Required Skills**
- Deep expertise in information security risk assessment, control evaluation, and risk management frameworks.
- Strong audit and assurance knowledge, including testing and validation of controls.
- Excellent analytical and problem‑solving abilities.
- Advanced communication skills: clear written and verbal reporting to C‑level executives and regulators.
- Leadership and stakeholder management, with proven influence across cross‑functional teams.
- Familiarity with security standards, regulations, and emerging cyber threats (NIST, ISO 27001, PCI, SOX, GLBA, etc.).
- Ability to develop and execute remediation roadmaps and validate outcomes.
**Required Education & Certifications**
- Bachelor’s degree in Information Security, Computer Science, Business Administration, Finance, or related field.
- Advanced security or risk certifications (CISM, CISSP, CRISC, CGEIT, or equivalent) preferred.
- Minimum 10+ years of progressive experience in information security risk oversight, ideally within financial services or regulated industries.
- Demonstrated experience managing cross‑functional risk programs, engaging senior leadership, and communicating with audit and regulatory bodies.
New york city, United states
Hybrid
13-01-2026