Chief Information Security Office – Security Services & Cyber Defense Associate

Location: New York, NY

Job ID: 2026-4550

Category: Risk

Position Type: Full-Time

Posting Date: September 15, 2026

About Bank of China

Established in 1912, Bank of China is one of the largest banks in the world, with more than $3 trillion in assets and a footprint spanning over 60 countries and regions. The Bank’s long-term outlook, institutional strength, and global reach provide clients with a stable and reliable financial partner across Corporate and Personal Banking, Trade Services, Commodities, Financial Institutions, and Global Markets.

Overview

The Security Services & Cyber Defense Associate will support the Bank’s information security program across Security Architecture, Security Engineering, Security Operations, Identity & Access Management, Threat Management, Vulnerability Management, and Penetration Testing.

Responsibilities

Security Architecture, Security Engineering & Security Operations (45%)

• Provide security standards and requirements for in-house and third-party applications developed or procured by the Bank.
• Provide IT with security expertise and support in identifying solutions that meet established requirements.
• Manage assigned security monitoring tools for daily monitoring of network devices, platforms, databases, and applications.
• Design, configure, and enhance assigned security tools to support effective security event monitoring and escalation.
• Conduct security tool rule and configuration validations and recertify monitored devices.
• Identify and escalate security issues and assist with cybersecurity incident investigations.
• Perform regular maintenance of assigned security tools, including software upgrades, license updates, and fine-tuning of rules and configurations.

Threat Management, Vulnerability Management & Penetration Testing (45%)

• Conduct threat assessments and modeling as required.
• Conduct vulnerability scans of internal and external networks.
• Present results to IT and collaborate on analysis, criticality levels, and remediation timelines.
• Provide oversight of IT remediation efforts and track and report findings to the Information Security Committee.
• Coordinate penetration testing exercises in collaboration with IT.

Qualifications

• Bachelor’s degree in business, computer science, management information systems, engineering, mathematics, or a related field is required.
• At least one year of experience in information security, cybersecurity, vulnerability management, security architecture, networking, security tools, computer systems administration, or risk management.
• Understanding of regulatory requirements, including FFIEC, GLBA, and NIST.
• Knowledge of information security and cybersecurity best practices.
• Knowledge of systems administration, including Windows Server, Active Directory, firewalls, UNIX systems, and network architectures.
• Knowledge of security tools such as SIEM, DLP, XDR, EDR, and web filtering solutions.
• Understanding of protocol behavior and the validity of identified vulnerabilities.
• CISSP, CRISC, or other IT-related certifications are preferred.

Pay Range

Actual salary is commensurate with the candidate’s relevant years of experience, skill set, education, and other qualifications.

Salary Range: $42,000–$90,000 per year