Information Security Manager

Established in 1744, Sotheby’s promotes access and ownership of exceptional art and luxury objects through auctions, private sales and retail. Our deep expertise across 70 selling categories is supported by a leading technology platform and a global network of specialists spanning 40 countries. Selling categories include Contemporary Art, Modern and Impressionist Art, Old Masters, Chinese Works of Art, Jewelry, Watches, Wine and Spirits and Design, as well as collectible cars and real estate through RM Sotheby’s and Concierge. Sotheby’s Financial Services is a leading art lender and provides capital solutions for collectors around the world, having originated more than $12 billion in loans since its inception. Sotheby’s new global headquarters is now open at the iconic Breuer building at 945 Madison Avenue in New York City.

As an Information Security Manager, you will be responsible for executing major components of Sotheby’s information security strategy, as well as helping to define it. Reporting directly to the CISO, you will be the driving force behind accomplishing key initiatives, while working closely with managers across the globe to balance achieving business objectives with managing risk.

Rather than being confined to a narrow role, you will be a utility player, moving between different areas as needed, for example: performing risk assessments and security reviews, procuring infosec tools, managing projects, drafting policies and processes, conducting risk management meetings, designing controls, overseeing auditors, and leading incident response. And as a key part of a team dedicated to continuous improvement, you will help us get better every day.

You obsess over getting the key facts nailed down. You have an attention to detail that some might call “extreme”. And you recognize the daunting challenge of managing information security at a historic and globally recognized brand, but that challenge excites you.

• →Work with IT and business unit managers to drive security initiatives to completion
• →Lead business continuity and disaster recovery planning and preparation projects
• →Lead internal and external security audits, acting as the primary point of contact for auditors
• →Draft, update, and enforce information security policies, processes, and standards
• →Conduct third-party vendor risk assessments and internal security risk assessments
• →Maintain risk registers, compliance dashboards, and reports for senior leadership
• →Audit internal systems to verify compliance with mandatory security controls
• →Develop policies, processes, and risk assessments aligned to top frameworks such as CIS, NIST, ISO 27001, and SOC 2
• →Crosswalk and harmonize controls across multiple compliance frameworks
• →Document security requirements, support control implementation, and help track remediation progress
• →Build risk registers, support assessments, and monitor remediation progress
• →Plan, lead, and execute control validation and testing activities across various domains (e.g., access management, vulnerability management, incident response, data protection)
• →Mentor junior analysts and engineers, providing guidance on control validation methodologies and best practices while fostering a culture of accountability
• →Document control issues and collaborate with stakeholders to develop remediation recommendations
• →Develop and enhance control testing methodologies, procedures, and reporting mechanisms

• At least five years of hands-on experience in information security roles
• Bachelor's or Master’s in computer science, engineering, or cybersecurity
• Deep understanding of information security fundamentals
• Proven ability to manage complex projects from conception to completion
• Ability to explain complex technical risks in simple, business-friendly language
• Ability to communicate clearly, precisely, and concisely

• At least one active credential, such as CISA, CRISC, CISM, or CISSP
• Experience performing risk assessments across diverse systems including SaaS and mobile
• Deep knowledge of frameworks and standards such as CIS, ISO 27001, and NIST
• Experience leading incident response through a cyberattack or data breach