Cybersecurity Governance, Risk and Compliance Manager

SF Fire Credit Union•San Francisco, CA

1d•$144,800 - $217,000

About The Position

SF Fire Credit Union is seeking a full-time Cybersecurity Governance, Risk and Compliance Manager to provide independent oversight of the Credit Union’s cybersecurity risk. Operating independently of the CIO and IT management reporting lines, the role reviews IT cybersecurity practices and control effectiveness, challenges decisions to defer remediation or accept risk, and ensures material cybersecurity issues reach appropriate decision makers. Success requires deep cybersecurity expertise, sound judgment, and the ability to communicate clearly and challenge constructively across IT, Information Security, Compliance, Legal, and business leadership. The position should have sufficient access to relevant systems documentation, policies, incident records, assessment results, and personnel to carry out its oversight responsibilities. It should be authorized to request corrective action plans, challenge proposed remediation timelines, recommend safeguards, and escalate unresolved concerns without IT management approval. For material risks requiring immediate protective action, the role should be empowered to recommend urgent containment measures and invoke a defined escalation process. Any authority to direct or suspend technology operations should be established in the organization’s governance framework, with clear decision rights, emergency procedures, and coordination requirements with the CIO and CRO. The role should be appropriately resourced for the institution’s size and risk profile; its initial structure may be a dedicated manager or an appropriately qualified individual with a clearly defined mandate, provided independence, expertise, and authority are maintained. Responsibilities may evolve with organizational needs and strategic priorities.

Requirements

Bachelor’s degree in Information Security, Computer Science, or a related field.
At least 7 years of progressive cybersecurity experience or related experience in IT, Compliance, or Audit.
One or more CISSP, CCSP, CISM, GIAC, CISA, CRISC, or PCI-related certifications, including PCIP, ISA, or QSA.
Deep cybersecurity expertise, sound judgment, and the ability to communicate clearly and challenge constructively across IT, Information Security, Compliance, Legal, and business leadership.

Nice To Haves

Advanced degree preferred.

Responsibilities

Independently review IT cybersecurity practices, policies, configurations, procedures, and control effectiveness.
Assess whether IT’s responses to emerging vulnerabilities, security advisories, and threat intelligence are timely and proportionate to the institution’s risk exposure.
Recommend improvements to IT controls, processes, resource allocation, and remediation plans.
Challenge decisions to defer remediation or accept cybersecurity risks, and require documented justification and appropriate risk acceptance.
Establish expectations for sharing material cybersecurity information among IT, Information Security, Marketing, Compliance, Legal, business leadership, and affected functions.
Verify that relevant stakeholders are notified when a threat may affect the organization, its website, customer-facing systems, confidential information, or business operations.
Ensure threat assessments and recommended actions are communicated to appropriate decision makers with clear ownership and deadlines.
Independently monitor remediation of identified cybersecurity weaknesses and verify completion of material corrective actions.
Maintain a risk-based register of significant cybersecurity issues, remediation commitments, overdue actions, and accepted risks.
Escalate material or overdue issues to the CRO and, when appropriate, the CEO or appropriate board committee.
Provide periodic reporting on cybersecurity risk exposure, control effectiveness, incident response, phishing trends, and outstanding remediation.
Request corrective action plans, challenge proposed remediation timelines, recommend additional safeguards, and escalate unresolved concerns without IT management approval.
Recommend urgent containment measures and invoke a defined escalation process when a material risk requires immediate protective action.