This role pays more than
52%
of similar roles. Most pay
$132,000–$195,681
— the shaded band above.
At the midpoint, this role pays about
$161k
versus about
$164k
for comparable roles.
Based on 240 similar postings.
Employer
About State Street
State Street Corporation is one of the world''s largest custodian banks and asset managers, providing investment servicing, investment management, and investment research to institutional investors. Industry: Financial Services & Asset Custody
State Street currently has
206 open roles
on FindRole.
Listed pay typically runs
$120,000–$202,500
across 200 roles with salary data.
The Vice President, Business Information Security Officer serves within the first line of defense to provide cyber risk management oversight for various business units and legal entities. This role involves leading a team to deliver cyber advisory services, building application- and service-level threat models, and providing metrics that support executive decision-making. The successful candidate will perform cyber risk assessments at the platform and system levels while integrating security reviews into lifecycle processes like incident management and vulnerability management. Key technical competencies include cloud and multi-cloud security, networking, identity and access management, and cryptography. Additionally, the role requires expertise in emerging technologies such as generative AI, machine learning, and blockchain. The position functions as a trusted advisor to bridge the gap between global cybersecurity goals and business operations to reduce residual risk within a large financial firm.
Perform cyber risk assessments at the application, platform, and system levels to identify vulnerabilities and determine necessary protections.
Develop and own application-specific and service-level threat models for business units.
Translate technical security risks into clear, actionable business terms for non-technical senior leadership.
Manage and escalate information security risks in alignment with the firm's risk appetite and requirements.
Integrate security risk reviews into lifecycle processes including incident management, vulnerability management, and third-party risk.
Deliver executive-ready presentations regarding protection outcomes, threat models, and control results to senior leadership.
Act as a trusted advisor to business leaders to influence the adoption of cyber controls and reduce residual risk.
Monitor and manage emerging technologies, including generative AI risks and multi-cloud security requirements.
What we're looking for
Bachelor’s degree in Computer Science, a related technical field, or equivalent work-aligned experience.
CISSP or CISM certification is required.
5+ years of experience working with business leadership across enterprise projects.
Practitioner-level depth in at least two focus areas including Multi-Cloud, AI, Machine Learning, Blockchain, Software Supply Chain, or Quantum Computing.
Ability to translate technical risk into clear, actionable business terms for both technical and non-technical audiences.
Familiarity with recognized standards and frameworks such as NIST CSF 2.0, NIST SP 800-53, or ISO 27001.
CRISC, CISA, SSCP, CCSP, CEH, or GIAC certifications (preferred).
Emerging-tech or AI security certification, such as ISACA AAISM (preferred).