Apply Now

Portfolio Information Security Officer

• Posted 2 hours ago • Updated 2 hours ago

Full Time

On-site

Fitment

Dice Job Match Score™

🫥 Flibbertigibetting...

Job Details

Skills

Security Controls
Product Engineering
Leadership
Business Planning
Software Architecture
Enterprise Architecture
DevOps
Cloud Computing
Authentication
Authorization
Incident Management
Auditing
SAP GRC
Privacy
Computer Science
Information Technology
Risk Management
Information Security
Reporting
Security Architecture
IT Risk
IT Risk Management
Financial Services
Health Insurance
NIST 800-53
ISO/IEC 27001:2005
COBIT
CISSP
CISM
ISACA
Cisco Certifications
CISA
Amazon Web Services
Microsoft Azure
Presentations
Fluency
Software Security
Software Development Methodology
Cloud Security
Network Security
Data Security
Encryption
API
Vulnerability Management
DevSecOps
Continuous Integration
Continuous Delivery
Regulatory Compliance
Communication
Management
Business Acumen
Relationship Management
FOCUS
Accountability

Summary

Position Overview

The Portfolio Information Security Officer (PISO) is a senior, director-level leader serving as the primary security advisor for assigned lines of business. Reporting to the Deputy Chief Information Security Officer, the PISO aligns business objectives with enterprise security requirements, advises on cyber and technology risk, and ensures application, architecture, and engineering initiatives incorporate appropriate security controls. This role influences senior stakeholders across technology, product, engineering, operations, risk, compliance, and business leadership, translating complex technical issues into actionable business risk decisions and driving remediation aligned to regulatory expectations, operational resilience, and enterprise security strategy.
Key Responsibilities

Business Unit Security Leadership: Own the security relationship for assigned portfolios; participate in business planning and governance; ensure leaders understand current and emerging risks, control gaps, remediation obligations, and risk acceptance decisions; connect enterprise security functions with business and technology teams to align priorities to outcomes.
Cyber Risk Advisory and Prioritization: Advise on remediation prioritization, compensating controls, exceptions, and formal risk acceptance; assess findings based on likelihood, impact, exploitability, regulatory exposure, operational criticality, and customer impact; develop practical risk treatment plans; present time-bound risk acceptance recommendations with accountable ownership; escalate material risks to appropriate governance forums.
Application Architecture and Engineering Reviews: Provide technical security advisory for application architecture, cloud deployments, integrations, APIs, identity patterns, and third-party connectivity; partner with enterprise architecture, engineering, DevOps, cloud, and infrastructure teams to identify risk early; evaluate authentication, authorization, data protection, encryption, logging, segmentation, resilience, secrets management, secure configuration, and vulnerability exposure; ensure alignment to enterprise standards, secure SDLC, and regulatory requirements.
Risk Reporting and Governance: Produce business-unit-specific cyber risk reporting covering key risks, control gaps, remediation progress, exceptions, vulnerabilities, audit/regulatory issues, and emerging threats; deliver regular updates to business leaders and contribute to consolidated executive reporting; translate technical issues into clear business impact statements and decision materials; track commitments, risk acceptances, and issue closure.
Security Program Alignment: Drive adoption of enterprise capabilities and standards (e.g., vulnerability management, third-party risk, IAM, data protection, cloud security, incident response, threat management, awareness, secure development); identify gaps between policy and implementation; provide feedback to central security teams; support regulatory, audit, and compliance activities; partner with security architecture, GRC, risk, privacy, legal, compliance, and technology teams.
Incident, Threat, and Emerging Risk Support: Provide business context during incidents and investigations; advise leaders on exposure, remediation urgency, operational impact, and communications; lead post-incident risk reviews and ensure lessons learned inform sustainable control improvements.

Education and Experience

Bachelor's degree in Information Security, Computer Science, Information Technology, Engineering, Risk Management, or related field, or equivalent practical experience.
10+ years across information security, technology risk, application security, infrastructure, cloud security, security architecture, engineering, or related disciplines.
5+ years influencing senior technology, engineering, risk, or business stakeholders.
Demonstrated experience advising on cyber risk, control gaps, risk acceptance, remediation prioritization, and executive-level risk reporting.
Experience reviewing application, system, or platform designs for security risk and translating technical issues into business risk language for executives.
Preferred: Experience as a PISO/BISO or in security architecture, technology risk, or senior security advisory roles; regulated industry experience (e.g., financial services, healthcare, insurance, technology, critical infrastructure); familiarity with frameworks such as NIST CSF, NIST 800-53, ISO 27001, CIS Controls, COBIT, FAIR; relevant certifications (e.g., CISSP, CISM, CRISC, CCSP, CISA, SABSA, AWS/Azure security credentials); experience presenting to executive and board-level forums.

Knowledge, Skills, and Abilities

Broad technical fluency across application security and secure SDLC, cloud security architecture, IAM, infrastructure and network security, data protection and encryption, API and integration security, vulnerability management, DevSecOps and CI/CD, logging/monitoring/detection controls, third-party risk, resilience and continuity.
Strong risk judgment; ability to distinguish theoretical risk from material business risk and compliance exposure, and to recommend pragmatic treatments aligned to risk appetite.
Executive communication skills with the ability to prepare concise, decision-oriented materials and influence without direct authority.
Business acumen to connect security posture to strategy, revenue, operations, and customer impact.
Relationship management and prioritization skills to focus teams on the most impactful risks under resource constraints.
Ownership mindset to drive issues to closure, maintain accountability, and ensure transparent, time-bound risk decisions.

Travel Requirements

N/A
Physical Demands

Stationary Position: Frequently
Vision: 20/20 corrected vision
Hearing: Receive detailed information if spoken to

Working Conditions

N/A

Employers have access to artificial intelligence language tools (“AI”) that help generate and enhance job descriptions and AI may have been used to create this description. The position description has been reviewed for accuracy and Dice believes it to correctly reflect the job opportunity.

Dice Id: 90922487
Position Id: 24475206
Posted 2 hours ago

Create job alert

Never miss an opportunity! Create an alert based on the job you applied for.

Similar Jobs

Business Information Security Officer

New York, New York

•

18d ago

Business Information Security Officer, North America P&C Location: New York, NY; New Jersey; Boston, MA; or Philadelphia, PA Work Arrangement: Hybrid Reports To: Chief Business Technology Officer, North America P&C Employment Type: Full Time Help us insure it Tokio Marine HCC is a global industry-leading specialty insurance group, backed by the strength and stability of the Tokio Marine Group. Offering over 100 classes of specialty insurance, we empower clients to pursue opportunities confidentl

Full-time

USD 156,700.00 - 345,800.00 per year

CRO - Information Security & Risk Oversight Lead

New York, New York

•

Today

Description & Requirements The energy of a newsroom, the pace of a trading floor, the buzz of a recent tech breakthrough; we work hard, and we work fast - while keeping up the quality and accuracy we're known for. It's what keeps us inventing and reinventing, all the time. Our culture is wide open, just like our spaces. We bring out the best in each other through collaboration. Through our countless volunteer projects, we also help network with the communities around us, too. You can do amazing

Full-time

USD 215,000.00 - 290,000.00 per year

Vice President, Cybersecurity and Deputy Chief Information Security Officer

New York, New York

•

Today

The mission of The New York Times is to seek the truth and help people understand the world. That means independent journalism is at the heart of all we do as a company. It's why we have a world-renowned newsroom that sends journalists to report on the ground from nearly 160 countries. It's why we focus deeply on how our readers will experience our journalism, from print to audio to a world-class digital and app destination. And it's why our business strategy centers on making journalism so good

Full-time

USD 275,000.00 - 290,000.00 per year

Director IT Risk and Security Management

Hybrid in Jersey City, New Jersey

•

Today

Are you ready to make an impact at DTCC? Do you want to work on innovative projects, collaborate with a dynamic and supportive team, and receive investment in your professional development? At DTCC, we are at the forefront of innovation in the financial markets. We're committed to helping our employees grow and succeed. We believe that you have the skills and drive to make a real impact. We foster a thriving internal community and are committed to creating a workplace that looks like the world t

Full-time

Search all similar jobs