> Markdown version of [/jobs/ext/4455786-senior-director-information-security-manager-cyber-grc-frameworks-policies-controls](https://www.wearedevelopers.com/jobs/ext/4455786-senior-director-information-security-manager-cyber-grc-frameworks-policies-controls). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Director, Information Security Manager (Cyber GRC Frameworks/Policies/Controls)

- **Company:** The Bank of New York Mellon Corporation
- **Location:** New York, NY, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Control Objectives for Information and Related Technology (COBIT), Cyber Security, Software Vulnerability Management, Software Security, Information Technology
- **Published:** October 26, 2026
- **Apply:** https://diversityjobs.com/career/18733362/Senior-Director-Information-Security-Manager-Cyber-Grc-Frameworks-Policies-Controls-New-York-New-York

## About the Role

* Bachelor's degree in computer science or a related discipline, or equivalent work experience required, advanced degree preferred. 15+ years of experience in information security or related technology experience required, experience in the securities or financial services industry is a plus.
 * Bachelor's degree or equivalent experience in Cybersecurity, Information Security, Risk Management, Technology, or a related discipline.
 * Significant experience in Cyber GRC, technology risk, control framework management, cyber policy, or related governance functions.
 * Strong understanding of cybersecurity control domains, including identity, infrastructure, application security, vulnerability management, resilience, and third-party risk.
 * Experience designing or managing policy hierarchies, standards frameworks, and control inventories in a complex enterprise environment.
 * Knowledge of risk and control mapping, control rationalization, and governance processes.
 * Ability to translate regulatory, audit, and operational requirements into practical control requirements.
 * Strong written communication and stakeholder management skills.

## Description

* Lead development, maintenance, and modernization of cyber governance frameworks, policies, standards, and control principles.
 * Define and maintain a common cyber control taxonomy and control framework aligned to enterprise risk, regulatory obligations, and technology domains.
 * Rationalize control inventories to reduce duplication, remove ambiguity, and improve consistency across Platforms and shared services.
 * Map controls to risks, policy requirements, standards, obligations, important services, and accountable owners.
 * Establish and govern exception processes for cyber standards and control requirements, including review, challenge, documentation, and escalation.
 * Partner with control owners and technology stakeholders to embed policy and control requirements earlier in the change, engineering, and delivery lifecycle.
 * Support control framework alignment across key domains such as identity, infrastructure, application security, third-party risk, and resilience.
 * Define control objectives, minimum requirements, and design expectations to support consistent assessment and testing outcomes.
 * Collaborate with governance and reporting teams to improve management transparency and control health reporting.
 * Drive policy refresh cycles based on threat change, regulatory developments, audit feedback, and strategic transformation priorities.
 * Contribute to integration of AI and emerging technology governance requirements into the broader cyber control architecture.
 * Support target-state enablement through improved workflow, data quality, and automated evidence opportunities.