Director, Information Security

First Entertainment Credit Union•Los Angeles, CA

95d•$150,000 - $190,000•Hybrid

About The Position

First Entertainment Credit Union is seeking a Director, Information Security to lead its information security program and protect information assets, technology infrastructure, and customer data. The Director develops security strategy; oversees cybersecurity operations, governance, risk, and compliance; ensures regulatory compliance; manages security risks; and partners across the organization to strengthen its security posture. The role serves as a trusted advisor on cybersecurity strategy, emerging threats, risk exposure, and security investments, and advises on security architecture, technology implementations, cloud adoption, and security requirements for new systems and initiatives. The Director maintains and enhances cyber resilience in partnership with the enterprise business, overseeing cyber recovery security requirements and coordinating with IT on disaster recovery, incident response planning, ransomware preparedness exercises, tabletop testing, and recovery readiness. IT retains ownership of technical disaster recovery execution. This is a full-time hybrid role in Hollywood, California, reporting to the VP, Enterprise Risk Management. The targeted pay range for candidates in California is $150,000 to $190,000. The role supports First Entertainment's mission to build lifelong relationships with people in the entertainment and creative industries and is expected to uphold its core values: Members First, Ownership, Integrity, Innovation, Inclusivity, and One Team.

Requirements

Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, or a related field.
10 or more years of progressive information security, cybersecurity, risk management, or IT governance experience, including 5 or more years in a leadership or people management role.
Strong knowledge of cybersecurity frameworks, standards, and regulations, including NIST Cybersecurity Framework, NIST 800-53, FFIEC guidance, GLBA, CIS Controls, ISO 27001, and applicable financial services regulatory requirements.
Experience conducting enterprise cyber risk assessments, maintaining risk registers, developing risk treatment plans, and integrating cyber risk into enterprise risk management programs.
Demonstrated experience applying GRC oversight and effective challenge to IT risk assessments, control design and effectiveness, and remediation plans, while maintaining boundaries between operational ownership, risk oversight, and independent assurance.
Proficiency in security operations, vulnerability management, threat intelligence, penetration testing, and third-party cybersecurity risk management programs.
Experience overseeing third- and fourth-party security risk across the vendor lifecycle, including evaluation of vendor assurance reports, material subcontractor dependencies, contractual security provisions, remediation, and residual risk.
Strong understanding of identity and access management, privileged access controls, segregation of duties, and security governance best practices.
Experience reviewing technology implementations, cloud environments, network architectures, and system designs to identify and mitigate security risks.
Knowledge of data protection and security-by-design practices, including data classification, encryption, data loss prevention, secure development, and security reviews for new technology and material changes.
Experience supporting business continuity, disaster recovery, cyber resilience planning, tabletop exercises, and ransomware preparedness activities.
Experience in incident governance and escalation, including coordination of material cyber incidents with IT, Legal, Compliance, ERM, and business leadership; notification assessments; and post-incident lessons learned.
Exceptional written, verbal, and presentation skills, including the ability to communicate across audience levels and translate technical exposures into business impacts, risk treatment options, investment priorities, and decisions requiring escalation to executive leadership and the Board.
Experience developing security roadmaps, managing program budgets and service providers, and prioritizing security investments and resources based on risk.

Nice To Haves

Master's degree preferred but not required.
Professional certification such as CISSP, CISM, CRISC, CISA, CGEIT, CCSP, or equivalent preferred but not required.
Prior experience in banking, credit union, financial services, fintech, or another highly regulated industry preferred but not required.

Responsibilities

Develop, execute, and continuously mature the enterprise Information Security Program, including strategy, governance frameworks, policies, standards, procedures, roadmaps, and annual planning initiatives.
Establish security governance practices aligned with organizational objectives and provide risk insights and strategic recommendations to executive leadership and the Board.
Provide GRC oversight and challenge of IT and the Information Security Program, including security requirements, control assessments, risk and remediation reviews, policy exceptions, and escalation of material security risks, while maintaining separation from Internal Audit assurance.
Oversee security operations, including security monitoring, incident detection and response, SOC coordination, forensic investigations, remediation, and escalation of unresolved security risks.
Oversee IAM security requirements, including least-privilege access, privileged access management, user access certifications, and segregation of duties compliance.
Manage vulnerability and threat management programs, including vulnerability assessments, penetration testing, threat intelligence, remediation prioritization, patch management oversight, and ongoing risk monitoring.
Oversee information security risk throughout the third-party vendor lifecycle, including due diligence, risk assessments, control reviews, ongoing monitoring, remediation, and escalation, in partnership with Enterprise Risk Management, IT, vendor management, and business owners.
Ensure compliance with applicable cybersecurity laws, regulations, frameworks, and standards, including NCUA, FFIEC, GLBA, PCI DSS, NIST, and CIS Controls.
Manage cybersecurity audit and examination readiness, including regulatory requests, evidence collection, control assessments, corrective actions, policy exceptions, risk acceptance, and remediation tracking.
Manage cyber resilience and recovery readiness, including incident response planning, ransomware preparedness, tabletop exercises, recovery assessments, and coordination with business continuity and IT.
Develop and promote enterprise security awareness and education, including phishing simulations, executive cybersecurity education, and initiatives that foster a security-first culture.
Develop and maintain cybersecurity KRIs, KPIs, dashboards, and reporting processes, and administer and optimize GRC platforms and tools.