Chief Information Security Officer

Alerus • Fargo, ND

3d • $200,000 - $250,000

About The Position

The Vice President, Chief Information Security Officer (CISO) is the senior executive responsible for establishing, leading, and continuously maturing Alerus’s enterprise-wide information security strategy. Reporting directly to the Chief Risk Officer, the CISO oversees security policies, programs, and technologies that protect the confidentiality, integrity, and availability of customer, employee, and institutional data across all lines of business. The role works closely with senior leadership, technology teams, risk functions, and business units to embed security into organizational strategy, operations, and culture, and participates in IT Management to mature the company’s technology environment and mitigate current and future information security risks.

The CISO is the primary cybersecurity resource for executive management, the Board of Directors, and bank regulators, and serves as a trusted advisor on emerging cyber threats, technology risk, and digital resilience. This position leads the security strategy, architecture, operations, incident response, risk assessment, compliance, governance, reporting, awareness, and team development functions described in the responsibilities. Work is typically performed in an office setting.

Requirements

• Bachelor’s degree in computer science, cybersecurity, management information systems, or a related field, or an equivalent combination of education and relevant experience.
• 10+ years of progressive information security experience, including at least 5 years in a leadership role.
• Demonstrated experience building and maturing an enterprise information security program in a regulated financial institution or comparably regulated environment.
• Executive-level communication and influence skills, including translating technical risk into business impact for executives, board committees, regulators, and non-technical stakeholders.
• Experience leading enterprise cyber risk assessments, security architecture, vulnerability management, penetration testing, remediation governance, and control-effectiveness testing.
• Experience developing and providing an information security awareness and training program.
• Experience developing and maintaining information security policies and standards.
• Demonstrated command of the NIST Cybersecurity Framework, FFIEC IT Examination Handbook guidance, CIS Controls, and banking regulatory expectations; working knowledge of ISO 27001 and SOC 2.
• Practical technical depth in cloud and hybrid architecture, network and endpoint security, identity and access management, encryption, data protection, application security, and secure software development.
• Knowledge of GLBA Section 501(b), related Interagency Guidelines, PCI DSS, Sarbanes-Oxley requirements, state privacy and breach-notification laws, and relevant federal and state banking regulatory expectations.
• Current Certified Information Systems Security Professional (CISSP) certification.

Nice To Haves

• CISM, CISA, CRISC, or CCSP certification.
• Experience leading information security within banking, wealth management, retirement services, payments, or another regulated financial services organization.
• Experience with banking regulatory examinations, audit remediation, and executive and board reporting.
• Hands-on leadership experience in cloud security, secure architecture, DevSecOps, and technology transformation.
• High ethical standards, sound judgment under pressure, and a strong commitment to protecting clients and the company.
• Experience building security teams and managing co-sourced security capabilities, managed security service providers, and specialized consultants.

Responsibilities

• Develop, implement, and continuously update the company’s multi-year information security strategy, roadmap, and operating plan in alignment with business objectives and risk appetite; define measurable outcomes and maturity targets.
• Establish and maintain information security policies, standards, and procedures aligned with banking laws and regulations and recognized frameworks, including FFIEC guidance, the NIST Cybersecurity Framework, and CIS Controls.
• Ensure systems comply with security policies, standards, and practices, and recommend and direct solutions for non-compliant systems.
• Establish enterprise security architecture requirements across cloud, on-premises, third-party, and hybrid environments; conduct or approve security design reviews for material technology changes.
• Monitor evolving threats and regulatory requirements, including risks related to cloud, artificial intelligence, and digital banking; adjust strategy, controls, and resources and advise cross-functional leaders on impacts.
• Direct vulnerability management, penetration testing, attack-surface management, and remediation governance, including risk-based prioritization and escalation of overdue critical issues.
• Direct security operations, threat intelligence, threat hunting, monitoring, detection, and response, including oversight of managed security service providers.
• Own, maintain, and test the Computer Security Incident Response Plan through exercises and simulations; serve as executive incident commander for material events and coordinate containment, recovery, communications, regulatory notifications, and post-incident reviews.
• Lead and advise on control frameworks for identity and access management, data classification, encryption, data loss prevention, endpoint and network security, cloud security, application security, secure software development, and DevSecOps.
• Lead enterprise cybersecurity risk and security program maturity assessments; identify critical systems, data, and business services and verify appropriate risk treatment plans and controls.
• Own the information security budget, workforce plan, and external service strategy; prioritize investments with IT and business leaders based on risk reduction, business impact, regulatory expectations, and financial analysis.
• Lead cybersecurity oversight across the third-party lifecycle, including due diligence, contract security requirements, monitoring, concentration and supply-chain risk, remediation, and secure termination.
• Serve as the primary cybersecurity subject matter expert and contact for internal and external audits and regulatory examinations; coordinate responses, corrective action plans, and remediation timelines.
• Partner with Business Continuity, Technology, Operations, and Risk to establish and test cyber recovery, disaster recovery, and operational resilience plans for critical services and technology dependencies.
• Collaborate with Legal and Compliance on compliance with GLBA Section 501(b), related Interagency Guidelines, PCI DSS, Sarbanes-Oxley requirements, and applicable state privacy and breach-notification laws.
• Maintain documentation and evidence demonstrating control design and operating effectiveness for regulatory reviews, audits, client due diligence, and cyber insurance underwriting.
• Partner with Enterprise Risk to develop, validate, and report risk and performance indicators, control effectiveness, program maturity, material issues, and remediation aging to the Enterprise Risk Management Committee and Risk Committee.
• Partner with Risk to incorporate cyber risk into the Bank’s risk appetite statement and enterprise risk management framework.
• Present quarterly or more frequently to the Board Risk Committee on cybersecurity posture, program effectiveness and maturity, roadmap progress, emerging threats, material incidents, regulatory posture, and investment priorities.
• Provide clear, board-appropriate cybersecurity risk reporting and translate technical risk into business impact for non-technical stakeholders.
• Design and oversee enterprise security awareness and role-based training, including phishing simulations and measures of effectiveness.
• Build, lead, and develop a high-performing information security team, including succession planning and staff development.
• Partner with Data, Technology, Legal, Compliance, and Risk leaders to establish security requirements and governance for artificial intelligence systems and third-party AI tools.
• Perform other duties as assigned.

Benefits

• Competitive compensation, including base salary and bonus and/or incentive opportunities.
• Comprehensive benefits, including medical, dental, vision, life, and long-term disability insurance.
• 401(k) and ESOP retirement savings plans.
• Flexible time off, company-paid holidays, parental leave, and bereavement leave.
• Learning and development resources and advancement opportunities.
• Access to financial experts, financial wellness tools, and discounts on Alerus products and services.
• Paid volunteer time and a company donation match opportunity.

What This Job Offers

• Job Type: Full-time
• Career Level: Executive