Information Security Officer

About the role

The Information Security Officer (ISO) is responsible for developing, implementing, and overseeing the Bank’s Information Security Program to protect customer information, banking systems, and technology assets. The ISO ensures compliance with applicable federal and state banking regulations, industry standards, and internal policies while serving as the primary advisor to the Chief Risk Officer on cybersecurity risk. This position works closely with Information Technology, Risk Management, Internal Audit, Compliance, and other business units to maintain an effective, risk-based security program that supports the Bank’s security objectives.

Responsibilities

• Develop, implement, and oversee the Bank’s Information Security Program
• Ensure compliance with federal and state banking regulations, industry standards, and internal policies
• Serve as the primary advisor to the Chief Risk Officer on cybersecurity risk
• Collaborate with Information Technology, Risk Management, Internal Audit, Compliance, and other business units
• Maintain an effective, risk-based security program aligned with the Bank’s security objectives

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or related field (or equivalent experience)
• Five or more years of progressively responsible experience in information security, cybersecurity, risk management, or IT security
• Demonstrated knowledge of banking regulations and cybersecurity requirements
• Experience developing and administering enterprise security programs
• Strong understanding of:
  • Cybersecurity frameworks (NIST CSF, CIS Controls, CRI)
  • Security risk assessments
  • Identity and Access Management
  • Vulnerability Management
  • Incident Response
  • Business Continuity and Disaster Recovery
  • Vendor Risk Management
• Excellent written and verbal communication skills
• Ability to communicate technical risks
• One or more of the following certifications are preferred:
  • CISSP
  • CISM
  • CRISC
  • GIAC certifications
  • Security+
  • Certified Ethical Hacker (CEH)
• Experience in financial institutions or other highly regulated industries is preferred
• Knowledge of Microsoft Azure, Microsoft 365 security, Active Directory, and cloud security is preferred
• Experience with endpoint detection and response (EDR), SIEM, vulnerability management, and cyber operations is preferred
• Familiarity with automation and orchestration technologies is preferred
• Programming or scripting experience (Python, PowerShell, SQL, JavaScript, or similar) is preferred
• Data analytics, business intelligence, or dashboard development experience (Power BI, Tableau, Superset, or similar) is preferred
• Experience querying and analyzing large datasets is preferred
• Experience with security metrics, KPIs, and reporting is preferred
• Satisfactory Credit and Background Checks

Physical Requirements

• Sitting: 70%
• Standing: 10%
• Walking: 20%
• Fine manipulation of hands: 80%
• Lifting: 10% (30-50 lbs.)
• Carrying: 10% (30-50 lbs.)
• Pushing/Pulling: 5%
• Bending/Squatting: 20%
• Reaching overhead: 5%