Director, Information Security

About the role

The Director of Information Security is a collaborative partner that seeks opportunities to learn and engage across the organization. The Director will direct and evolve UFCU’s enterprise information security and cyber risk program while enabling secure innovation and outstanding Member experiences.

This role serves as a trusted advisor to executive leadership and the Board, championing a member-first, security-by-design culture that safeguards trust while supporting growth and innovation. This position is based in Austin, Texas and requires frequent onsite engagement at UFCU Plaza to support executive collaboration, enterprise risk governance, cross-functional partnership, and operational leadership across the organization.

Responsibilities

• Define and own UFCU’s enterprise information security and cyber risk strategy, roadmap, and policies in alignment with business objectives, risk appetite, budgets, and regulatory expectations
• Lead the design, implementation, and operation of a comprehensive cyber security program covering governance, architecture, infrastructure, networking, cloud security, application security, IAM, vulnerability management, and security operations
• Embed security-by-design practices into digital banking, payments, and member-facing platforms by partnering with Technology, Product, and Enterprise Risk teams
• Establish and maintain an effective information security governance framework, including standards, policies, and leadership forums that align cyber security priorities with enterprise goals
• Ensure compliance with applicable regulatory and industry frameworks, including NCUA guidance, GLBA Safeguards Rule, NIST, ISO, and PCI (as applicable)
• Lead internal and external examinations, audits, and assessments; oversee remediation plans and ensure sustainable closure of findings
• Partner with Technology, Risk, and business leaders to support business continuity, disaster recovery readiness, cyber resiliency, and enterprise operational resilience initiatives
• Present cybersecurity risks, trends, incident readiness, and strategic recommendations to executive leadership, risk committees, and other governance groups as needed
• Provide executive oversight of day-to-day cyber security operations, including threat monitoring, detection, and response across enterprise cyber security platforms
• Own and mature UFCU’s incident response and crisis management framework, ensuring effective coordination, communication, and executive reporting
• Partner with peer leaders to ensure the effectiveness and resilience of critical services
• Lead information security components of third-party risk management
• Oversee data protection, privacy controls, and secure data-sharing practices across the data lifecycle in collaboration with Legal, Compliance, and Data & Insights teams
• Build, lead, and develop a high-performing information cyber security organization across Governance, Risk, Compliance, Engineering, Architecture, and Security Operations
• Collaborate across Technology, Digital, Operations, Risk, Compliance, and Member-facing teams to balance security, experience, and innovation
• Serve as UFCU’s senior cyber security advisor to executives and the Board, translating technical risk into clear business impact and investment decisions
• Communicate program, progress, risk posture, investment using metrics-driven reporting
• Collaborate with business partners to determine future needs and support necessary to achieve business unit strategy
• Network with other financial institutions and cyber risk leaders to learn and share best practices
• Develop Information Security strategies in partnership with executive leadership to drive achievement of Credit Union and department goals
• Monitor and evaluate department progress toward stated goals and make adjustments as needed based on business and department needs
• Facilitate procurement of tools and resources to achieve organizational and department strategic priorities
• Establish Information Security annual budget with identification of planned expenses for new or enhanced programs and services
• Ensure effective control of results
• Take action to guarantee achievement of departmental objectives that fall within designated budgets
• Monitor expenses on a monthly basis to evaluate versus budget using strong financial management skills
• Take action to make adjustments as needed based on organizational and department priorities
• Collaborate with senior leaders on development of organizational annual budget in alignment with strategic objectives

Qualifications

• Bachelor’s degree in Information Security, Computer Science, Information Systems, Engineering, Business or relevant field of study or equivalent combination of education and experience
• Minimum of ten (10) years of related experience in information security or related technology disciplines
• Minimum of seven (7) years of management and supervisory leadership experience developing and leading teams with direct reporting relationships
• Five to seven (5–7+) years of experience leading cybersecurity teams with accountability for strategy, budget, and vendor management
• Prior experience in a senior security leadership role (Director, Head of Security, Deputy CISO, or CISO), preferably within financial services or another regulated industry
• Experience supporting regulatory exam