Chief Information Security Officer

Alerus • Minnetonka, MN

3d • Onsite

About The Position

The Vice President, Chief Information Security Officer (CISO) is the senior executive responsible for establishing, leading, and continually maturing Alerus’s enterprise-wide information security strategy. Reporting directly to the Chief Risk Officer, the CISO oversees security policies, programs, and technologies that protect the confidentiality, integrity, and availability of customer, employee, and institutional data across all lines of business. The role works closely with senior leadership, technology teams, risk functions, and business units to embed security in organizational strategy, operations, and culture, and is part of IT Management to help the company’s technology environment mature and address current and future information security risks.

The CISO is the primary cybersecurity resource for executive management, the Board of Directors, and bank regulators, and advises on emerging cyber threats, technology risk, and digital resilience. The position leads the information security team and program; manages security strategy, architecture, operations, risk, incident response, compliance, third-party oversight, resilience, reporting, and investment priorities. Work is typically performed in an office setting.

Requirements

• Bachelor’s degree in computer science, cybersecurity, management information systems, or a related field, or an equivalent combination of education and relevant experience.
• 10+ years of progressive information security experience, including at least 5 years in a leadership role.
• Demonstrated experience building and maturing an enterprise information security program in a regulated financial institution or comparably regulated environment.
• Executive-level communication and influence skills, including translating technical risk into business impact for executives, board committees, regulators, and non-technical stakeholders.
• Experience leading enterprise cyber risk assessments, security architecture, vulnerability management, penetration testing, remediation governance, and control-effectiveness testing.
• Experience developing and providing an information security awareness and training program.
• Experience developing and maintaining information security policies and standards.
• Demonstrated command of the NIST Cybersecurity Framework, FFIEC IT Examination Handbook guidance, CIS Controls, and banking regulatory expectations; working knowledge of ISO 27001 and SOC 2.
• Practical technical depth in cloud and hybrid architecture, network and endpoint security, identity and access management, encryption, data protection, application security, and secure software development.
• Knowledge of GLBA Section 501(b), related Interagency Guidelines, PCI DSS, Sarbanes-Oxley requirements, state privacy and breach-notification laws, and relevant federal and state banking regulatory expectations.
• Current Certified Information Systems Security Professional (CISSP) certification.
• High ethical standards, sound judgment under pressure, and a strong commitment to protecting clients and the company.

Nice To Haves

• CISM, CISA, CRISC, or CCSP certification.
• Experience leading information security within banking, wealth management, retirement services, payments, or another regulated financial services organization.
• Experience with banking regulatory examinations, audit remediation, and executive and board reporting.
• Hands-on leadership experience in cloud security, secure architecture, DevSecOps, and technology transformation.
• Experience building security teams and effectively managing co-sourced security capabilities, managed security service providers, and specialized consultants.

Responsibilities

• Develop, implement, and continually update the company’s multi-year information security strategy, roadmap, and operating plan, with measurable outcomes and maturity targets.
• Establish and maintain information security policies, standards, and procedures aligned with banking regulations and frameworks including FFIEC guidance, the NIST Cybersecurity Framework, and CIS Controls; ensure systems comply and direct remediation of non-compliant systems.
• Establish enterprise security architecture requirements across cloud, on-premises, third-party, and hybrid environments, and conduct or approve security design reviews for material technology changes.
• Monitor evolving threats and regulations, including risks involving cloud, artificial intelligence, and digital banking, and advise leadership on implications for the company.
• Direct vulnerability management, penetration testing, attack-surface management, and remediation governance, including risk-based prioritization and escalation of overdue critical issues.
• Direct security operations, threat intelligence, threat hunting, monitoring, detection, and response, including oversight of managed security service providers.
• Own, maintain, and test the Computer Security Incident Response Plan; lead material incident response and coordinate containment, recovery, communications, regulatory notifications, and post-incident reviews.
• Lead and advise on control frameworks for identity and access management, data classification, encryption, data loss prevention, endpoint and network security, cloud and application security, and secure software development and DevSecOps.
• Lead enterprise cybersecurity risk and security-program maturity assessments; identify critical systems, data, and business services and verify risk treatment plans and controls provide appropriate protection.
• Own the information security budget, workforce plan, and external service strategy, prioritizing investments based on risk reduction, business impact, regulatory expectations, and financial analysis.
• Lead cybersecurity oversight across the third-party lifecycle, including due diligence, contract requirements, ongoing monitoring, concentration and supply-chain risk, remediation, and secure termination.
• Serve as the primary cybersecurity subject matter expert for internal and external audits and regulatory examinations; coordinate responses to findings, corrective action plans, and remediation timelines.
• Partner with Business Continuity, Technology, Operations, and Risk to establish and test cyber recovery, disaster recovery, and operational resilience plans for critical services and technology dependencies.
• Collaborate with Legal and Compliance on compliance with GLBA Section 501(b), related Interagency Guidelines, PCI DSS, Sarbanes-Oxley requirements, and applicable state privacy and breach-notification laws.
• Maintain documentation and evidence demonstrating control design and operating effectiveness for regulatory reviews, audits, client due diligence, and cyber insurance underwriting.
• Partner with Enterprise Risk to develop, validate, and report key risk and performance indicators, control effectiveness, program maturity, material issues, and remediation aging to the Enterprise Risk Management Committee and Risk Committee.
• Partner with Risk to incorporate cyber risk into the Bank’s risk appetite statement and ERM framework.
• Present quarterly, or as needed, to the Board Risk Committee on cybersecurity posture, program effectiveness and maturity, roadmap progress, emerging threats, incidents, regulatory posture, and investment priorities; translate technical risk into business impact.
• Design and oversee enterprise security awareness and role-based training, including phishing simulations and effectiveness measures.
• Build, lead, and develop a high-performing information security team, including succession planning and staff development.
• Partner with Data, Technology, Legal, Compliance, and Risk leaders to establish security requirements and governance for AI systems and third-party AI tools.
• Perform other duties as assigned.

Benefits

• Competitive compensation including base salary and bonus and/or incentive opportunities.
• Medical, dental, vision, life, and long-term disability insurance.
• 401(k) and ESOP retirement savings plans.
• Flexible time off and company-paid holidays.
• Parental and bereavement leave.
• Learning and development resources and advancement opportunities.
• Access to financial experts, financial wellness tools, and discounts on Alerus products and services.
• Paid volunteer time and a company donation match opportunity.

What This Job Offers

• Job Type: Full-time
• Career Level: Executive