Director, Information Security

BluPeak Credit Union • San Diego, CA

1d

About The Position

The Director, Information Security is BluPeak’s enterprise information security leader and Information Security Officer. The role maintains, enhances, and administers the Information Security Policy and Program, protecting member data and sensitive business information and supporting the integrity and confidentiality of BluPeak technology systems. As part of the Risk Management team, the Director provides second-line risk oversight through independent risk assessment, monitoring, challenge, and reporting, while partnering with first-line technology and business teams to identify, manage, and escalate risks. The position evaluates technology, systems, information assets, and third-party services for risk, control effectiveness, and alignment with applicable regulations and industry standards.

The Director works with senior leadership and governance committees to mature the cybersecurity program and align security initiatives with organizational goals. The role oversees security risk assessments, third-party information security risk management, incident-response risk oversight, vulnerability reporting, security technologies, and employee security awareness training. It also serves as a liaison to regulators, examiners, and external auditors, supports a security-conscious culture, and supervises up to two employees.

Requirements

• Bachelor’s degree in information technology, cybersecurity, information systems, or a closely related field, plus at least three years of relevant professional experience; alternatively, an associate degree or related certificate plus at least five years of relevant experience; or at least seven years of relevant experience in lieu of a degree or certificate.
• Relevant professional experience in information security, cybersecurity, security governance, or closely related disciplines.
• Experience in financial, medical, Department of Defense, or another highly regulated environment.
• Demonstrated expertise in network and data security practices and policies.
• Demonstrated expertise in incident prevention and response management.
• Demonstrated expertise in auditing, testing, and regulatory examinations.
• Demonstrated expertise in Governance, Risk, and Compliance (GRC) frameworks.
• Demonstrated expertise in third-party risk management.
• Advanced knowledge of network and endpoint security, cloud, IAM, SIEM/logging, vulnerability management, and vendor risk.
• Ability to handle highly confidential information with discretion.
• Strong analytical and executive communication skills.
• Strong written, verbal, and listening communication skills, with the ability to communicate effectively with staff across varying levels of technical expertise.
• Strong organization and prioritization skills.

Nice To Haves

• CISSP, CISA, CISM, GIAC, or CRISC certification.

Responsibilities

• Advise senior leadership, committees, working groups, and stakeholders on cybersecurity strategy and develop, govern, and mature a program integrated with business goals, compliance mandates, risk frameworks, and organizational strategy.
• Maintain a resilient security posture in response to emerging and sophisticated threats.
• Develop and continuously improve the Information Security Policy and Program in alignment with applicable standards, regulations, and guidelines, including GLBA, FDIC, NCUA, CIS, NIST, and PCI.
• Prepare and present the annual Information Security Program report to the Board of Directors, including program status, risk assessments, and future initiatives.
• Develop information security policies and procedures for presentation to the Information Technology Steering Committee.
• Administer security risk assessments, identify vulnerabilities, and work with stakeholders to prioritize remediation.
• Provide subject-matter expertise in AI and emerging-technology risk governance and provide input on the security budget.
• Establish and monitor security metrics and key risk indicators.
• Direct third-party information security risk management, including due diligence, SOC 1 and SOC 2 report evaluations, and validation of vendor user-control requirements.
• Perform identity and access governance reviews, collaborate on data classification, oversee cloud security, and consult on security reviews for projects and changes.
• Liaise with regulators, examiners, and external auditors on information security matters.
• Administer employee security-policy exceptions through established approval processes, including OCONUS travel, software requests, and DLP website whitelisting.
• Oversee the information security incident-response framework, providing risk oversight and monitoring response efforts, investigations, root-cause analyses, escalation, remediation, and reporting.
• Manage vulnerability reporting to support timely identification and remediation of system vulnerabilities.
• Oversee the critical cybersecurity technology stack, including SIEM, antivirus/antimalware, and endpoint protection solutions, in collaboration with internal teams and external vendors.
• Provide threat intelligence and cyber insurance support.
• Monitor and promptly escalate critical and high-risk security issues and vulnerabilities to appropriate committees and management, recommending solutions and actions.
• Manage employee security awareness training, including education, testing, and compliance reporting.
• Build partnerships across internal departments to integrate security into business processes, system designs, and technology deployments.
• Participate in special projects and perform other duties as assigned.
• Follow company policies and procedures, complete annual compliance training, and comply with business continuity and vendor management policies.
• Comply with anti-money-laundering requirements, including the Bank Secrecy Act, OFAC, and USA PATRIOT Act, and related procedures for customer identification, due diligence, OFAC match processing, and reporting unusual activity or suspected fraud.
• Directly supervise up to two employees and carry out supervisory responsibilities in accordance with organizational policies and applicable laws.
• Champion BluPeak’s culture, purpose, and values through integrity, accountability, and collaboration.

What This Job Offers

• Job Type: Full-time
• Career Level: Director