Senior Information Security Engineer

Responsibilities

• Provide independent assessments of information security risks, controls, and processes across technology environments, applications, infrastructure, and third‑party relationships
• Evaluate the design and effectiveness of security controls against established frameworks, regulatory requirements, and industry best practices
• Identify, analyze, and communicate cybersecurity risks, vulnerabilities, control weaknesses, and emerging threats to risk and business stakeholders
• Support governance and oversight of security domains including identity and access management, vulnerability management, cloud security, application security, data protection, and cybersecurity operations
• Conduct risk assessments for new technologies, projects, systems, and business initiatives to evaluate potential security and operational risks
• Provide effective challenge to first‑line security practices, risk decisions, control implementations, and remediation strategies
• Monitor and assess information security metrics, key risk indicators (KRIs), control effectiveness measures, and trends to identify emerging risks and opportunities for improvement
• Support development and maintenance of information security risk management policies, standards, methodologies, and governance processes
• Participate in regulatory examinations, internal audits, risk reviews, and compliance assessments by preparing analysis, documentation, and responses to requests
• Partner with Technology, Information Security, Compliance, Enterprise Risk, Internal Audit, and business stakeholders to strengthen risk management practices and improve control maturity
• Prepare reporting and presentations that communicate technical risks, control gaps, and security trends to a variety of audiences
• Support oversight of third‑party technology providers and critical vendor security risk management activities
• Stay current on cybersecurity threats, regulatory developments, emerging technologies, and industry practices to evaluate potential impacts to the organization

• Bachelors degree in field relevant to role (or 4 additional years of relevant experience in lieu of a degree)
• 4 – 6 years of relevant experience
• Knowledge of information security frameworks and standards such as NIST CSF, NIST 800‑53, ISO 27001, CIS Controls, or FFIEC guidance
• Familiarity with regulatory expectations applicable to financial services environments
• Understanding of cybersecurity domains, particularly artificial intelligence (AI), cloud security, network security, and data protection
• Ability to provide solutions for the safe usage of AI technologies in a financial services organization
• Experience with Model Context Protocol (MCP) governance
• Experience with Microsoft Copilot, OpenAI ChatGPT, Anthropic Claude and other similar technologies
• Familiarity with AI security tools such as Palo Alto Prisma AI runtime security (AIRS), Crowdstrike Falcon AI Detection and Response (AIDR) or other similar tools
• Deep experience with securing and governing Microsoft Azure and Amazon Web Services (AWS)
• Experience with cloud security tooling such as Orca, Prisma Access Cloud, Wiz or other similar tools
• Strong analytical and problem‑solving skills with the ability to evaluate complex security and technology risks
• Ability to provide objective risk assessments and effective challenge while building collaborative stakeholder relationships
• Support the ability to “shift left” and incorporate security early on and throughout the development lifecycle
• Strong written and verbal communication skills with the ability to translate technical concepts into business‑focused risk discussions