Head of Information Security

Fiserv•Remote, Colorado, CO

1d•$127,500 - $204,000•Remote

About The Position

MoneyPass Group (MPG) is seeking a hands-on Head of Information Security to establish and lead the company's information security, cyber risk, and security governance capabilities as MPG builds its independent technology environment. This leader will be responsible for defining MPG's security strategy, establishing an effective security control environment, managing cyber risk, and ensuring that security responsibilities are effectively executed across MPG and its technology partners. MPG operates a highly outsourced technology model in which managed service providers and other strategic partners deliver significant portions of infrastructure, application development, ATM technology, cloud, and security services. As a result, this role requires a leader who can effectively govern third-party security services while maintaining clear accountability for MPG's security posture. The successful candidate will combine security leadership, technical depth, risk management, compliance expertise, and strong vendor governance with the willingness to personally drive execution in a lean organization.

Requirements

Hands-on Head of Information Security
Establish and lead the company's information security, cyber risk, and security governance capabilities
Defining MPG's security strategy
Establishing an effective security control environment
Managing cyber risk
Ensuring security responsibilities are effectively executed across MPG and its technology partners
Effectively govern third-party security services
Maintaining clear accountability for MPG's security posture
Combine security leadership, technical depth, risk management, compliance expertise, and strong vendor governance
Willingness to personally drive execution in a lean organization
Experience with SOC 1, SOC 2, PCI DSS, NIST Cybersecurity Framework, CIS Controls
Experience with Gramm-Leach-Bliley Act (GLBA), FTC Safeguards Rule and Privacy Rule
Experience with California Consumer Privacy Act (CCPA/CPRA)
Experience with EU and UK General Data Protection Regulation (GDPR)
Experience with AI governance programs

Nice To Haves

Director / VP, depending on candidate experience

Responsibilities

Develop and maintain MPG's enterprise information security strategy, roadmap, policies, standards, and control framework aligned with the company's business objectives and risk tolerance.
Establish security governance across MPG's corporate technology, payment and ATM environments, cloud services, software platforms, data platforms, and third-party technology ecosystem.
Define security roles and responsibilities across MPG, its MSP/MSSP providers, software partners, and other critical vendors.
Establish and maintain the company's cyber risk register and regularly communicate material risks, remediation priorities, and security posture to the CIO and executive leadership.
Develop meaningful security metrics and executive reporting, including risk trends, vulnerabilities, incidents, control effectiveness, third-party risk, and remediation progress.
Provide oversight of MPG's security operations capabilities, including: Security monitoring and SIEM, Managed detection and response (MDR), Endpoint detection and response (EDR), Vulnerability management, Threat intelligence, Identity monitoring, Cloud security monitoring, Email and collaboration security, Security incident detection and response.
Manage and hold MPG's MSSP and other security providers accountable to defined SLAs, security requirements, escalation procedures, and performance metrics.
Ensure vulnerabilities are appropriately identified, prioritized, assigned, remediated, and tracked through closure.
Lead MPG's cyber incident response program, including incident response plans, escalation procedures, tabletop exercises, forensic coordination, regulatory/customer notification support, and post-incident reviews.
Serve as MPG's primary security leader during significant cybersecurity incidents.
Establish and oversee MPG's identity and access management program, including: Single sign-on and multifactor authentication, Privileged access management, Joiner/mover/leaver processes, Role-based access, Periodic access certification, Service and privileged account governance, Third-party access, Segregation of duties.
Partner with IT and business leaders to implement appropriate least-privilege and Zero Trust principles across MPG's environment.
Establish security architecture principles and requirements for MPG's technology environment.
Review material technology implementations and architecture changes for security risks and required controls.
Partner with infrastructure, development, data, and MSP teams to incorporate security into cloud architecture, networks, endpoints, applications, APIs, integrations, and data platforms.
Establish appropriate security practices throughout the software development lifecycle, including code scanning, dependency management, secrets management, application security testing, and remediation processes.
Ensure new technologies—including AI and generative AI solutions—are evaluated for security, privacy, data protection, access, and third-party risks before production use.
Own the technology security control environment supporting MPG's compliance and customer assurance requirements.
Partner with Legal, Finance, Internal Audit, Compliance, and external auditors to establish and maintain readiness for applicable frameworks and requirements, including: SOC 1, SOC 2, PCI DSS, where applicable, NIST Cybersecurity Framework, CIS Controls, Applicable customer, contractual, regulatory, and privacy requirements.
Translate compliance requirements into sustainable operational controls rather than point-in-time audit activities.
Maintain appropriate evidence demonstrating control operation and effectiveness.
Coordinate security-related audit activities and drive remediation of findings through closure.
Establish MPG's third-party technology and cybersecurity risk management program.
Define minimum security requirements for MSPs, MSSPs, SaaS providers, software development partners, data providers, and other critical vendors.
Perform or oversee security assessments of critical vendors and review relevant SOC reports, penetration testing results, certifications, control exceptions, and remediation plans.
Maintain clear MPG-versus-provider responsibility matrices for critical security controls.
Ensure contracts contain appropriate cybersecurity, incident notification, data protection, audit, business continuity, and security-control requirements.
Actively challenge providers rather than assuming outsourced technology means outsourced accountability.
Partner with MPG's data and technology teams to establish security controls governing sensitive corporate, customer, transaction, payment, and endpoint data.
Establish standards for: Data classification, Encryption, Key management, Data access, Data retention and destruction, Data loss prevention, Secure data transfer, Sensitive-data discovery and monitoring.
Work with the business to reduce unnecessary retention and exposure of sensitive information.
Partner with Legal, Compliance, and business leaders to operationalize MPG's data privacy obligations, translating them into sustainable technical and operational controls, including applicable requirements under: Gramm-Leach-Bliley Act (GLBA), including the FTC Safeguards Rule and Privacy Rule requirements for protecting customer financial information, California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable U.S. state privacy laws, EU and UK General Data Protection Regulation (GDPR), where MPG processes personal data of individuals in those jurisdictions.
Maintain MPG's written information security program consistent with GLBA Safeguards Rule requirements, including periodic risk assessments, service provider oversight, and regular reporting to executive leadership and the Board.
Support data inventories, data mapping, and records of processing, and conduct privacy and data protection impact assessments for new systems, products, vendors, and material changes.
Embed privacy-by-design principles—including data minimization, purpose limitation, and retention limits—into architecture reviews and the software development lifecycle.
Enable timely and secure fulfillment of consumer and data subject rights requests, including access, deletion, correction, and opt-out, with appropriate identity verification.
Ensure incident response plans address privacy breach notification obligations and timelines, including GDPR supervisory authority notification, GLBA Safeguards Rule notification, and state breach-notification laws.
Ensure vendor contracts include appropriate data processing terms, such as GDPR data processing agreements and cross-border transfer mechanisms, CCPA service-provider provisions, and GLBA safeguarding requirements.
Partner with Legal, Compliance, Data, and business leaders to establish and lead MPG's AI governance program, including: AI acceptable-use policies and employee guidance, An inventory of AI use cases, models, and AI-enabled vendor products, Risk-tiering and approval processes for internal and third-party AI solutions, Controls governing the use of customer, personal, and confidential data in AI prompts, training, and outputs.