Chief Information Security Officer (CISO)

Credit Acceptance•Southfield, MI

1d•$300,000 - $400,000•Hybrid

About The Position

Credit Acceptance is seeking a Chief Information Security Officer (CISO), also titled Vice President, Engineering - Security, Compliance and Trust, to lead the company’s information security strategy and organization. The role is responsible for keeping the business secure and compliant as it moves to the cloud and adopts AI agents. The CISO is the company’s designated CISO for regulatory purposes, reports to the CTO, has direct access to the Audit Committee, and provides updates to executive leadership and the Board. The CISO leads teams across security operations, security engineering—including application, cloud, identity and AI security—and governance, risk and compliance. The role partners with Engineering, Legal, Risk and Fraud to integrate security into business and technology work. The position is hybrid, based from Southfield, Michigan; Bellevue, Washington; or the San Francisco Bay Area, with two work-from-home days and three in-office days each week. The position owns enterprise security strategy; security for the migration from on-premises data centers to AWS; vulnerability and exposure operations; identity and privileged access for people, services and agents; data protection and privacy; vendor cyber risk; threat detection and incident response; and security controls for AI systems and agents. It also leads software security automation, regulatory compliance and audit response, Board reporting, the Information Security Compliance Committee, and the development of the security team and a security-aware culture. The role’s target base salary range is $300,000–$400,000. It is eligible for equity and annual cash bonuses. Final compensation depends on factors including hub location, role-specific skills, experience, industry background, education and certifications.

Requirements

Bachelor’s degree; computer science or a related field is preferred.
At least 10 years in information security, compliance, or a related field.
At least 10 years leading an information security, compliance, or risk team.
Regulatory compliance experience in financial services, such as GLBA, NYDFS Part 500, SOX, and PCI DSS.
Experience leading business continuity and cyber incident response, including executive tabletop exercises and response to a significant incident.
Strong familiarity with NIST CSF, ISO 27001/27002, and SOC 2.
Strong knowledge of cloud-native security architecture, including identity and access management, encryption, network and endpoint controls, and vulnerability management.
Experience building security into CI/CD and software delivery.
Practical production experience securing AI-enabled systems or AI-assisted development, including identity and access, data protection, and testing.
Experience reporting security and risk to executive leadership and a Board.
Ability to design security architecture that is secure by default and enforced through automation rather than manual review.
Working knowledge of agent attacks and failure modes, including prompt injection, tool misuse, identity and privilege abuse, and memory poisoning, and of controls based on the OWASP Top 10 for Agentic Applications, NIST AI RMF, and ISO/IEC 42001.
Ability to weigh security risk against business value, decide what agents or teams may do autonomously, and communicate tradeoffs and evidence clearly.
Ability to communicate technical and AI risk as clear decisions for executives and the Board.
Ability to build a strong team, challenge the status quo, and earn trust across Engineering, Legal, Compliance, Risk, and the business.
Required degrees must be from institutions accredited by the Council for Higher Education Accreditation or equivalent.

Nice To Haves

Master’s degree.
Financial services, fintech, or consumer lending experience.
AWS and Databricks security at production scale, including securing a migration from on-premises infrastructure.
Production experience with agentic AI, including agent identity, governed tool access such as Model Context Protocol, runtime controls, and agent-specific incident response.
Experience with AI-assisted detection, triage, and response in a security operations center, with human oversight.
SEC cybersecurity disclosure experience as the security leader of a public company.
Experience assessing risk for AI systems and third-party AI vendors.
CISSP, CISM, or an equivalent security certification.

Responsibilities

Own the enterprise information security strategy, aligned with business goals, regulatory requirements, and Engineering’s AI and modernization plans.
Own security for the move from on-premises data centers to AWS, ensuring workloads use a secure standard landing zone and legacy technology is modernized or retired.
Lead vulnerability and exposure operations, with AI-assisted prioritization and an accountable person for each decision.
Own identity and privileged access for people, services, and agents.
Own data protection and privacy, including classification, handling standards, controls on sensitive data, and privacy engineering across the product lifecycle and AI systems.
Manage third-party and vendor cyber risk from due diligence through ongoing monitoring, including security service providers, auditors, penetration testers, and AI partners.
Lead threat detection and incident response, including playbooks for compromised or misbehaving agents and executive tabletop exercises.
Work with Fraud and Operations to defend against AI-enabled attacks such as deepfake impersonation and synthetic identity fraud.
Define AI-agent security controls with Engineering architecture and platform leaders, including agent identities, least-privilege access, governed tool and data access, decision policies, testing, audit trails, and suspension capabilities.
Maintain an inventory of AI systems, agents, and AI features in purchased tools, including unsanctioned use; establish acceptable-use, data-handling, and third-party AI standards aligned with NIST AI RMF and ISO/IEC 42001.
Build security into software specification, generation, testing, and deployment, including AI-assisted development, using automated gates in place of manual reviews.
Lead compliance with GLBA, NYDFS Part 500, SOX IT general controls, PCI DSS, state privacy laws, and SEC cybersecurity disclosure requirements, including audit and examiner response and automated evidence systems.
Report security to the Board, including regular updates, the annual NYDFS Part 500 CISO report, and annual NYDFS certification, using decision-oriented metrics.
Lead the Company’s Information Security Compliance Committee, which meets at least quarterly with the Company’s Executive Leadership Team.
Build and develop the security team through hiring, professional development, AI-related skills development, and fostering a security-aware culture across Engineering and the business.
Remain compliant with company policies, processes, and legal guidelines.
Perform other duties as assigned and attend as required by the department.