Director, Information Security

Technology Credit Union•San Jose, CA

1d•Hybrid

About The Position

The Director, Information Security leads Technology Credit Union’s Information Security Program to protect member, employee, and organizational information. The role provides strategic, regulatory, and operational leadership; oversees security controls, technologies, and incident response; and advises executives and committees on cybersecurity risk and program effectiveness. The Director partners with technology and business leaders to securely enable emerging technologies, leads Information Security staff, and promotes a collaborative, risk-aware culture. The Director leads the program’s strategy, priorities, roadmaps, performance measures, and continuous improvement; oversees security operations, architecture, platforms, and incident response; and directs information security governance, risk, and compliance activities. The role also leads security governance for AI systems and services, including defining requirements and overseeing assessments of AI-related security risks. This is a full-time role, typically working 40 or more hours per week on a flexible schedule within Pacific Time core business hours, Monday through Friday. Occasional early or late hours and extended weekend hours may be needed, typically with advance notice. Work is in an office environment, with remote work possible as determined by business need and individual performance. Occasional travel to Tech CU locations or offsite events may be required. The position requires a bachelor’s degree in a relevant technical or business discipline and at least six years of progressive information security or cybersecurity experience. A master’s degree and relevant professional certifications are preferred. The listed San Jose, California salary range is $154,000 to $222,000, with a target bonus of 20% of base salary based on company and individual performance. Remote salaries are adjusted by geographic location.

Requirements

Bachelor’s degree in Information Security, Computer Science, Information Technology, Computer or Information Systems, emerging technologies, or a related technical or business discipline.
At least 6 years of progressive information security or cybersecurity experience, including technical, hands-on responsibilities and security leadership roles.
Advanced knowledge of information security program management, security architecture, defense in depth, cybersecurity operations, risk management, and data protection.
Advanced knowledge of SIEM, EDR/XDR, identity and access security, vulnerability management, DLP, cloud security, IDS/IPS, firewalls, network security, and incident response technologies.
Knowledge of NCUA, FFIEC, GLBA, NIST, PCI-DSS, and related regulatory or industry frameworks.
Knowledge of AI security risks, governance principles, control design, data-protection considerations, third-party AI risk, monitoring requirements, and secure AI lifecycle practices.
Excellent written, verbal, presentation, and data-storytelling skills.
Strong leadership, coaching, team-development, and motivational skills.
Strong analytical, problem-solving, organizational, and decision-making skills.
Ability to translate business, regulatory, and technical risks into practical and appropriately scaled security controls.
Proven ability to influence stakeholders and build effective relationships across business, technology, risk, audit, compliance, and executive functions.
Ability to manage multiple priorities, security roadmaps, projects, incidents, and remediation activities concurrently.
Ability to communicate complex security risks clearly and concisely to executives, directors, regulators, auditors, technical teams, and business stakeholders.
Demonstrated initiative, adaptability, accountability, attention to detail, and ability to work effectively in a lean, collaborative environment.

Nice To Haves

Master’s degree in business, cybersecurity, information systems, or a related field.
One or more relevant professional certifications, such as CISSP, CISM, CRISC, GIAC, or an equivalent information security, risk, cloud security, or AI governance certification.

Responsibilities

Lead the Information Security Program, including strategy, priorities, roadmaps, performance measures, and continuous improvement aligned with organizational objectives, regulatory expectations, and risk.
Advise executives, committees, and the Board of Directors on cybersecurity risk, program performance, audit results, remediation, and key metrics.
Manage, mentor, and develop Information Security staff while providing hands-on technical and operational leadership.
Partner with technology and business leaders to securely enable strategic initiatives and emerging technologies.
Evaluate security technologies and recommend solutions aligned with business needs and risk.
Direct security monitoring, threat detection, investigation, containment, and incident response.
Oversee security architecture and platforms across endpoint, identity, data, cloud, network, vulnerability management, and incident response.
Evaluate attack vectors, vulnerabilities, threat intelligence, security events, and control gaps; direct appropriate remediation or risk-treatment activities.
Lead security governance for AI systems and services, and define security requirements for their acquisition, development, configuration, integration, and use, including third-party AI services.
Oversee AI security assessments covering data exposure, unauthorized access, insecure integrations, misuse, third-party dependencies, and monitoring.
Develop, maintain, and enforce information security policies, standards, guidelines, procedures, risk-assessment methodologies, and governance processes.
Ensure the Information Security Program addresses applicable financial-services regulatory and industry requirements, including NCUA, FFIEC, GLBA, and NIST frameworks.
Direct information security risk assessments, control assessments, gap analyses, and remediation activities.
Manage the Information Security Risk Register by documenting, prioritizing, assigning, treating, accepting, and escalating risks.
Support internal and external audits, regulatory examinations, and security assessments, and oversee remediation of related findings.
Support Tech CU’s mission and values; meet regularly with the manager to discuss goal alignment, performance metrics, and development plans.
Comply with organizational policies and procedures, the employee Code of Conduct and Business Ethics, regulatory requirements, and internal controls and security measures.

Benefits

Medical, dental, and vision plans.
Life and disability insurance.
401(k) plan with company match.
12 paid holidays annually.
Paid time off accruing at 7.08 hours per bi-weekly paycheck, approximately 23 days per year, with increases based on length of service.
Eight hours of annual Voluntary Time Off for full-time employees to support charitable organizations.
Flexible Spending Accounts.
Employee-paid voluntary benefits.
Leaves of absence in compliance with state and federal regulations.
Target bonus of 20% of base salary based on company and individual performance.