Director, Information Security

Technology Credit Union•San Jose, CA

2d•$154,000 - $222,000

About The Position

The Director, Information Security, leads Technology Credit Union’s Information Security Program to protect member, employee, and organizational information. The role provides strategic, regulatory, and operational leadership; oversees security controls, technologies, and incident response; and advises executives and committees on cybersecurity risk and program effectiveness. The Director partners with technology and business leaders to securely enable emerging technologies, leads Information Security staff, and promotes a collaborative, risk-aware culture. The Director establishes the program’s strategy, priorities, roadmaps, performance measures, and continuous-improvement activities. The role oversees security operations, engineering, architecture, monitoring, threat detection, incident response, and AI security governance. It also develops and enforces security policies and governance processes, manages risk assessments and the Information Security Risk Register, and supports audits and regulatory examinations. This is a full-time position, typically 40+ hours per week, with a flexible schedule within core Pacific Time business hours Monday through Friday. Occasional early or late hours and extended weekend hours may be needed, typically with advance notice. The typical working environment is an office, with remote work possible as determined by business need and individual performance. Occasional travel to Tech CU locations or offsite events may be required, sometimes including overnight travel. The role routinely uses standard office equipment, including a computer, phone, and other devices. Physical requirements include speaking and listening, reading a computer screen and keyboarding for up to 70% of the day, sitting for extended periods, and mobility to attend meetings. The salary range for work based in San Jose, California, is $154,000–$222,000, with a midpoint of $188,000. Remote salary is adjusted based on geographic location. Typical starting pay is between the minimum and midpoint, depending on experience and qualifications. The position has target bonus potential of 20% of base salary based on company and individual performance. Benefits include medical, dental, and vision plans; life and disability insurance; a 401(k) plan with company match; 12 paid holidays annually; PTO accruing at 7.08 hours per bi-weekly paycheck (approximately 23 days per year) and increasing with length of service; eight annual hours of voluntary time off for full-time employees to support charitable organizations; flexible spending accounts; employee-paid voluntary benefits; and leaves of absence in compliance with state and federal regulations.

Requirements

Bachelor’s degree in Information Security, Computer Science, Information Technology, Computer or Information Systems, emerging technologies, or a related technical or business discipline.
At least 6 years of progressive information security or cybersecurity experience, including technical, hands-on responsibilities and security leadership roles.
Advanced knowledge of information security program management, security architecture, defense in depth, cybersecurity operations, risk management, and data protection.
Advanced knowledge of SIEM, EDR/XDR, identity and access security, vulnerability management, DLP, cloud security, IDS/IPS, firewalls, network security, and incident response technologies.
Knowledge of NCUA, FFIEC, GLBA, NIST, PCI-DSS, and related regulatory or industry frameworks.
Knowledge of AI security risks, governance principles, control design, data-protection considerations, third-party AI risk, monitoring requirements, and secure AI lifecycle practices.
Excellent written, verbal, presentation, and data-storytelling skills.
Strong leadership, coaching, team-development, and motivational skills.
Strong analytical, problem-solving, organizational, and decision-making skills.
Ability to translate business, regulatory, and technical risks into practical, appropriately scaled security controls.
Ability to influence stakeholders and build effective relationships across business, technology, risk, audit, compliance, and executive functions.
Ability to manage multiple priorities, security roadmaps, projects, incidents, and remediation activities concurrently.
Ability to communicate complex security risks clearly and concisely to executives, directors, regulators, auditors, technical teams, and business stakeholders.
Demonstrated initiative, adaptability, accountability, attention to detail, and ability to work effectively in a lean, collaborative environment.
May be required to travel occasionally to Tech CU locations and attend offsite training, meetings, or events, sometimes with overnight travel, typically with advance notice.
Ability to speak and listen to interact with internal and external parties in person or by phone; read a computer screen and perform keyboarding tasks for up to 70% of the day; sit for extended periods; and attend meetings.

Nice To Haves

Master’s degree in business, cybersecurity, information systems, or a related field.
One or more relevant professional certifications, such as CISSP, CISM, CRISC, GIAC, or an equivalent information security, risk, cloud security, or AI governance certification.

Responsibilities

Lead the Information Security Program, including its strategy, priorities, roadmaps, performance measures, and continuous improvement aligned with organizational objectives, regulatory expectations, and risk.
Advise executives, committees, and the Board of Directors on cybersecurity risk, program performance, audit results, remediation, and key metrics.
Manage, mentor, and develop Information Security staff, providing hands-on technical and operational leadership.
Partner with technology and business leaders to securely enable strategic initiatives and emerging technologies.
Evaluate security technologies and recommend solutions aligned with business needs and risk.
Direct security monitoring, threat detection, investigation, containment, and incident response.
Oversee security architecture and platforms across endpoint, identity, data, cloud, network, vulnerability management, and incident response.
Evaluate attack vectors, vulnerabilities, threat intelligence, security events, and control gaps; direct appropriate remediation or risk-treatment activities.
Lead security governance for AI systems and services.
Define security requirements for the acquisition, development, configuration, integration, and use of AI systems and third-party AI services.
Oversee AI security assessments covering data exposure, unauthorized access, insecure integrations, misuse, third-party dependencies, and monitoring.
Develop, maintain, and enforce information security policies, standards, guidelines, procedures, risk-assessment methodologies, and governance processes.
Ensure the Information Security Program addresses applicable financial-services regulatory and industry requirements, including NCUA, FFIEC, GLBA, and NIST frameworks.
Direct information security risk assessments, control assessments, gap analyses, and remediation activities.
Manage the Information Security Risk Register by documenting, prioritizing, assigning, treating, accepting, and escalating risks.
Support internal and external audits, regulatory examinations, and security assessments, and oversee remediation of related findings.
Support Tech CU’s Mission and Vision and demonstrate its values; meet regularly with the manager to discuss goals, performance metrics, and development plans; comply with policies, procedures, regulatory requirements, and internal controls; and uphold the employee Code of Conduct, Business Ethics, and workplace confidentiality.

Benefits

Medical, dental, and vision plans
Life and disability insurance
401(k) plan with company match
12 paid holidays annually
Paid time off accruing at approximately 23 days per year and increasing with length of service
Eight annual hours of voluntary time off for full-time employees to support charitable organizations
Flexible spending accounts
Employee-paid voluntary benefits
Leaves of absence in compliance with state and federal regulations
Target bonus potential of 20% of base salary based on company and individual performance