Head of Information Security Risk - Chief Risk Office

The energy of a newsroom, the pace of a trading floor, the buzz of a recent tech breakthrough; we work hard, and we work fast - while keeping up the quality and accuracywe'reknown for.It'swhat keeps us inventing and reinventing, all the time. Our culture is wide open, just like our spaces. We bring out the best in each other through collaboration. Through our countless volunteer projects, we also help network with the communities around us, too. You can do amazing work here. Work youcouldn'tdo anywhere else.It'sup to you to make it happen.

About the Role:
We’re looking for aHead of Information Security Riskwho can translate cybersecurity risk intobothexecutive insight andtechnicalsolutions.Reporting directly to our Head of Technology Riskas part of the Chief Risk Office, you will provide independent oversight, technicalconsultationand crediblechallengeacross the firm’s enterprise-wide information security program. Operating at the intersection ofcybersecurity, riskmanagement,governance,and strategy, you willbetheseniorcyber-riskpartnertotheChiefInformation SecurityOffice, Engineering, andChiefTechnologyOffice. You willengageontopicsrangingfrom technicalsecurity findings toprogrammaticdecisions and regulatorystrategyto ensurethe company isoperatingwithin its target risk appetiteand regulatory expectations. Your oversight will enableBloomberg’s seniorleadership to understand not only what the risks are, but where decisive action isrequiredto strengthen the firm’s overall security posture.

Key Responsibilities
* Serve as the primary Second Line advisor for cybersecurity-related risks and lead independent oversight and crediblechallengeof First LineofDefense activities.

* Evaluate and consult on the design and operating effectiveness ofsecurity programsandcontrols, particularly across complex, high-risk, or enterprise-scale technology initiatives.

* Review and challenge security-driven programs and initiatives to ensure alignment with enterprise risk appetite, industry control frameworks, and regulatory expectations.

* Partner closely with Information Security, CISO,ERM,and Engineering teams to enhance risk awareness, accountability, and control ownership.

*Identifyroot causes of control failures, security incidents, or systemic weaknesses and support the development of actionable, preventative recommendations.

* Prepare and present risk oversight materials to senior leadership committees, internal audit,Boardof Directors,andregulatory bodies asrequired.

* Act as a strategic thought partner to senior leaders by advising onemergingthreats, evolving regulatory requirements, and industry best practices.

*Attract,hireand manage a team of technical risk professionals toidentifyand measure threat-actorinitiatedrisks and risk scenariosthat mayimpactthe confidentiality, integrity, and availability of information systems.

Required Qualifications
*Bachelor’sDegreerequired.
* 10+ years of experience inone or more technicalInformation Securitydisciplines (security architecture, penetration testing,application security,cyber defense, etc.)
*Demonstratedexperience operating withinanindependent oversight functionas part of a Risk, Information Security, or Architecture team.
* Strong understanding of cybersecurity frameworks (e.g., NIST CSF,NIST 800-53,TLPT/TIBER-EU,MITREATT&CK,ISO 27001, COBIT, CIS).
* Experience interacting withBoards,regulators, internalaudit, and/orexecutive governance forums.
* Authorized to work in the United States.

Preferred Qualifications

* Relevanttechnical and/orprofessional certifications (e.g.,GIACGPEN/GDAT,CREST,FAIR,CISSP, CISM, CRISC, CISA).
* Experience in regulated industries (e.g., financial services).
* Strong understanding of cloud security, application security, identity and access management, and cyber resilience.
* Familiarity with enterprise risk management methodologies and risk appetite frameworks.

Core Competencies

* Strong analytical and critical thinking skills with the ability to provide constructivechallenge.
* Executive-level communication and presentation skills.
* Ability to influence without direct authority.
* Strategic mindset with strong attention to detail.
* High integrity and independent judgment.