Sr Business Information Security Officer

Your Responsibilities

• Own and continuously mature the LFS Written Information Security Program (WISP), supporting policies, and control framework, ensuring legal sufficiency and regulatory alignment.
• Define LFS-specific security standards and control baselines across origination, servicing, capital markets, and corporate functions in alignment with the enterprise security strategy.
• Lead the annual LFS security program review, including risk assessment and control gap analysis, and remediation roadmap, presenting findings to senior LFS and Enterprise leadership.
• Drive preparation and delivery of board and executive-level security risk materials, translating technical and regulatory complexity into clear, action-oriented narratives.
• Serve as the business and legal security subject matter expert in regulatory exams, audits, and investor reviews, owning response materials and corrective actions action plans.
• Interpret and operationalize GLBA, FFIEC, state privacy and cybersecurity laws, and investor security requirements across all LFS operations, partnering with Legal on litigation and enforcement exposure.
• Own the LFS information security risk register, providing independent challenge to security design decisions and escalating material risks through appropriate governance channels.
• Lead security incident governance, coordinating with the CISO, IT, and Legal on investigation, notification, and disclosure, and maintaining examination-ready documentation.
• Partner with Legal and Procurement to steer third-party security risk management, defining vendor review standards, and resolving unacceptable risk through governance channels.
• Champion team development and security awareness across LFS, providing leadership and mentorship to security risk Associates and driving required training completion.
• Contribute to enterprise security budget planning as the LFS subject matter lead, managing LFS-specific security spend and vendor relationships in coordination with enterprise leadership.

Your Toolbox

• Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, or Business Administration required; advanced degree (MBA, MS in Cybersecurity or Risk Management) preferred.
• 15+ years of progressive experience in information security, IT risk, regulatory compliance, or audit, including at least 5 years in a BISO or senior, business-facing a security leadership role.
• Financial services or mortgage industry experience required; non-depository Mortgage lenders experience a significant differentiator.
• Proven track record leading security programs through regulatory examinations, investor audits, and incident response, including board-level reporting.
• Deep knowledge of GLBA Safeguards Rule, FFIEC guidance, state privacy and cybersecurity laws, and investor security requirements (FNMA, FHLMC, Ginnie Mae).
• Working fluency in NIST CSF/800-53, ISO 27001/27002, SOC 2, and FAIR quantitative risk analysis frameworks.
• Demonstrated ability to quantify cyber risk in financial terms and communicate it clearly to executives, Board members, and Legal leadership.
• Strong written and oral communication skills, with experience producing board-quality materials and executive risk briefings.
• CISSP, CISM, or CRISC certification required (at least two); CISA, CGRC, or ISO 27001 Lead Auditor preferred.
• Working knowledge of GRC platforms, SIEM tools, identity and access management, and third-party risk management systems.
• Discretion and sound judgment in handling sensitive consumer financial data and confidential regulatory matters.