Director, Information Security

BluPeak Federal Credit Union•San Diego, CA

2d•$130,000 - $150,000

About The Position

The Director, Information Security leads BluPeak’s enterprise information security function and serves as the Information Security Officer. The role maintains, enhances, and administers the Information Security Policy and Program, protecting member data and sensitive business information and preserving the integrity and confidentiality of BluPeak’s technology systems. As part of the Risk Management team, the Director provides second-line risk oversight through independent assessment, monitoring, challenge, and reporting, while partnering with first-line technology and business teams to identify, manage, and escalate risks. The position maintains an understanding of BluPeak’s technologies, systems, information assets, third-party services, and applicable regulations and standards. The Director works with senior leadership and governance committees to align security initiatives with organizational goals and mature a forward-looking cybersecurity program. Responsibilities include overseeing security risk assessments, third-party security risk management, incident response oversight, vulnerability management, security technologies, employee awareness training, regulatory and audit liaison activities, and security policy exceptions. The role also advises on AI and emerging-technology risk governance and provides input on the security budget. The position directly supervises up to two employees and champions BluPeak’s culture, purpose, and values through integrity, accountability, and collaboration. Work outside standard business hours, including evenings, weekends, and holidays, may be required as needed.

Requirements

Bachelor’s degree in information technology, cybersecurity, information systems, or a closely related field, plus at least three years of relevant professional experience; alternatively, an associate degree or related certificate plus at least five years of relevant experience; or at least seven years of demonstrated relevant experience in lieu of a degree or certificate.
Relevant professional experience in information security, cybersecurity, security governance, or closely related disciplines.
Experience in financial, medical, Department of Defense, or other highly regulated environments.
Demonstrated expertise in network and data security practices and policies.
Demonstrated expertise in incident prevention and response management.
Demonstrated expertise in auditing, testing, and regulatory examinations.
Demonstrated expertise in Governance, Risk, and Compliance frameworks.
Demonstrated expertise in third-party risk management.
Advanced knowledge of network and endpoint security, cloud, identity and access management, SIEM/logging, vulnerability management, and vendor risk.
Ability to handle highly confidential information with discretion.
Strong analytical, executive communication, written, verbal, and listening skills, including the ability to communicate effectively with staff with varying levels of technical expertise.
Strong organization and prioritization skills.
Ability to work outside standard business hours, including evenings, weekends, and holidays, as needed.

Nice To Haves

CISSP, CISA, CISM, GIAC, or CRISC certification.

Responsibilities

Advise committees, working groups, senior leadership, and stakeholders on cybersecurity strategy and mature a program aligned with business goals, compliance mandates, risk frameworks, and organizational strategy.
Maintain a resilient security posture in response to emerging and sophisticated threats.
Develop and continuously improve the Information Security Policy and Program in alignment with applicable industry standards, regulations, and guidelines, including GLBA, FDIC, NCUA, CIS, NIST, and PCI.
Prepare and present the annual Information Security Program report to the Board of Directors.
Develop information security program policies and procedures for presentation to the Information Technology Steering Committee.
Administer security risk assessments, identify vulnerabilities, and prioritize remediation with relevant stakeholders.
Provide expertise in AI and emerging-technology risk governance and input on the security budget.
Establish and monitor security metrics and key risk indicators.
Direct third-party information security risk management, including due diligence, SOC 1 and SOC 2 report evaluations, and validation of user control requirements across vendors and technology partners.
Perform identity and access governance reviews, collaborate on data classification, oversee cloud security, and consult on project and change security reviews.
Act as liaison to regulators, examiners, and external auditors on information security matters.
Administer employee security policy exceptions, including OCONUS travel, software requests, and DLP website whitelisting, through established approval processes.
Provide risk oversight and monitoring of information security incident response, investigations, root cause analyses, escalation, remediation, and reporting.
Manage vulnerability reporting and ensure timely identification and remediation of system vulnerabilities.
Oversee critical cybersecurity technologies, including SIEM, antivirus/antimalware, and endpoint protection, in collaboration with internal teams and external vendors.
Provide threat intelligence and cyber insurance support.
Escalate critical and high-risk security issues and vulnerabilities to appropriate committees and management, and recommend solutions and actions.
Manage employee security awareness training, including education, testing, and compliance reporting.
Partner with internal departments to integrate security into business processes, system designs, and technology deployments.
Participate in special projects and perform other duties as assigned.
Follow company policies and procedures, complete annual compliance training, and comply with business continuity and vendor management policies.
Comply with anti-money laundering laws and related policies, including the Bank Secrecy Act, OFAC, and USA PATRIOT Act requirements.
Directly supervise up to two employees and carry out supervisory responsibilities in accordance with organizational policies and applicable laws.
Champion BluPeak’s culture, purpose, and values through integrity, accountability, and collaboration.