SVP/Chief Information Security Officer

About the role

It Starts With Our Employees FourLeaf's ultimate goal is to provide the best-in-class member and employee experience, and it all begins with two things: hiring incredible people and giving them a great place to work. The Senior Vice President (SVP)/Chief Information Security Officer (CISO) is responsible for establishing, executing, and continuously enhancing the Credit Union’s enterprise-wide information security and cybersecurity program.

Responsibilities

• Develop, implement, and maintain the Credit Union’s enterprise information security strategy, framework, policies, and standards.
• Implement and enforce enterprise security policies, procedures, and standards jointly developed with Second Line of Defense (2LOD) Risk Management and Compliance teams.
• Ensure alignment of security practices with applicable regulatory requirements, industry standards, and Credit Union business objectives.
• Provide regular reporting to executive management, Board committees, and regulators regarding cybersecurity risk, security posture, emerging threats, and remediation activities.
• Establish and maintain information security governance processes, metrics, and key risk indicators.
• Lead the Credit Union’s cybersecurity operations program, ensuring effective protection of information assets and infrastructure.
• Oversee enterprise threat detection, threat intelligence, security monitoring, incident response, and vulnerability management activities.
• Ensure timely response to security events and coordinate communication, recovery, and post-incident reviews.
• Oversee penetration testing, vulnerability assessments, security monitoring tools, and remediation programs.
• Own and manage the cybersecurity vendor risk assessment process for third-party service providers, fintech partners, and technology vendors.
• Evaluate and monitor the security posture of third-party technology relationships throughout the vendor lifecycle.
• Collaborate with Procurement, Legal, Information Technology, and Risk Management to ensure appropriate cybersecurity due diligence and contractual protections.
• Review vendor security controls, independent audit reports, penetration test results, and other security attestations.
• Ensure ongoing monitoring and remediation of identified vendor security risks.
• Partner with 2LOD teams to identify, assess, monitor, and mitigate information security and cyber risks.
• Support enterprise risk management initiatives by providing subject matter expertise on cyber and technology risks.
• Ensure compliance with NCUA guidance, FFIEC cybersecurity expectations, GLBA, state privacy requirements, and other applicable regulatory standards.
• Track and report remediation of audit findings and risk issues.
• Provide leadership and direction to information security personnel and external security partners.
• Foster a culture of cybersecurity awareness and accountability across the organization.
• Collaborate with Information Technology, Operations, Digital Banking, Enterprise Risk, Compliance, Internal Audit, and business line leaders to integrate security into business processes and technology initiatives.
• Advise senior management on security implications of strategic initiatives, digital transformation efforts, and emerging technologies.
• Oversee security awareness education and training programs for employees and stakeholders.

Qualifications