Information Security Officer

Richwood Bank•Richwood, OH

About The Position

The Information Security Officer (ISO) leads Richwood Bank’s information security program to protect customer and employee information, maintain the confidentiality, integrity and availability of bank systems, and support secure banking operations. The ISO combines program leadership with practical oversight of security operations, risk management, policies, architecture and employee awareness. The role directs assigned security personnel and coordinates managed security providers, incident response partners and virtual CISO resources, as applicable. The ISO works closely with systems and network teams, Compliance, Risk Management, Human Resources and business leaders to implement appropriate safeguards and communicate security priorities in business terms. All team members are expected to be active and engaged participants in Richwood Bank’s culture. The ISO develops and maintains a risk-based security program aligned with business objectives, risk appetite and applicable requirements. The role oversees security architecture and standards, policies and procedures, risk assessments, awareness training, business continuity and disaster recovery planning, governance reporting, security solution deployment, operational controls, incident response, audits and third-party risk. It also partners with IT, Compliance and legal counsel to address security risks, examinations, remediation and incident communications. Richwood Bank provides a comprehensive benefits package for full-time employees, including medical and wellness programs, dental, vision, an employee assistance plan, life insurance and supplemental short-term disability. Full-time and part-time employees have access to a 401(k) plan, an enhanced wellness program, tuition reimbursement and professional development opportunities. Candidates are subject to background and credit checks; employment is contingent upon results meeting company standards and applicable laws.

Requirements

Bachelor’s degree in information security, information technology, computer science or a related field, or an equivalent combination of relevant education and professional experience.
At least five years of progressive experience in information security or IT risk, including responsibility for security program activities, incident response or control oversight.
Experience coordinating security initiatives across teams and managing external security providers or comparable service relationships.
Working knowledge of security risk assessments, vulnerability management, identity and access controls, endpoint protection, network security, cloud security and incident response.
Ability to develop practical policies, interpret assessment findings, prioritize remediation and maintain clear documentation.
Strong judgment, organizational skills and the ability to explain security risks and recommendations to business leaders.
Strong decision-making skills, including the ability to weigh potential actions and identify appropriate choices.
Ability to influence others to modify opinions, plans or behaviors.
Understanding of organizational mission, values and goals, and ability to apply that understanding consistently.
Strong problem-solving, critical-thinking and troubleshooting skills.
Ability to establish and maintain effective working relationships and to exercise independent judgment.
Excellent analytical, mathematical and creative problem-solving skills.
Excellent listening, interpersonal, written and oral communication skills.
Logical and efficient approach with keen attention to detail.
Highly self-motivated and directed; ability to prioritize and execute tasks under pressure.
Strong customer service orientation.
Experience working in a team-oriented, collaborative environment.

Nice To Haves

Experience in a community bank, financial institution or other regulated environment, including participation in audits or regulatory examinations.
Knowledge of GLBA information security requirements, FFIEC guidance, NIST Cybersecurity Framework and third-party risk management practices.
CISSP, CISM, CRISC or a comparable information security certification.
Experience supervising staff or leading an information security program, including management and board reporting.
Experience with Microsoft 365 and Entra ID, endpoint detection and response, SIEM or managed detection services, privileged access management, firewalls, secure remote access and recovery technologies.

Responsibilities

Develop, maintain and measure a risk-based information security program aligned with the bank’s business objectives, risk appetite and applicable requirements.
Maintain security architecture, standards and control baselines with systems, network and application owners, and incorporate security into technology projects and changes.
Create and maintain security policies, standards, guidelines and procedures; coordinate their approval, communication, periodic review and documented exceptions.
Lead information security risk assessments, maintain a risk register, and recommend prioritized remediation plans with owners and target dates.
Develop and maintain the security awareness program, including onboarding, recurring training, phishing exercises and role-specific education.
Partner with business continuity and IT recovery owners to maintain and test continuity and disaster recovery plans, emphasizing cyber incidents, data restoration and critical banking services.
Report security risks, incidents, control effectiveness and remediation progress to senior management, the IT Steering Committee and the board or designated board committee.
Maintain an escalation path for significant risks and unresolved findings, including direct access to the designated executive or board committee when independent escalation is needed.
Recommend security priorities, staffing, training and budget needs; present risk treatment options and obtain documented risk acceptance from authorized management.
Monitor emerging threats, attack methods, security technologies and financial services risks, and recommend practical improvements appropriate to the bank’s size and complexity.
Evaluate and recommend security solutions through approved procurement and vendor management processes, and oversee their deployment, integration, configuration and validation with IT teams and providers.
Review new systems, cloud services, digital banking integrations, automation and AI use cases for security and data protection risks before implementation.
Oversee monitoring and protection of endpoints, servers, networks, cloud services, email, identities and data repositories through internal resources and managed providers.
Coordinate identity and access management, multifactor authentication, privileged access, remote access, encryption and data protection controls; oversee periodic access reviews.
Oversee vulnerability scanning, penetration testing and security assessments; prioritize findings, coordinate remediation with system owners and verify closure.
Monitor adherence to security policies and configuration standards, track exceptions and coordinate corrective actions.
Lead responses to suspected or confirmed information security incidents, coordinating investigation, containment, recovery, evidence preservation and lessons learned.
Maintain and exercise the incident response plan; coordinate escalation and communications with leadership, Compliance, legal counsel, insurers and response providers, as appropriate.
Work with Compliance and legal counsel to assess notification obligations and support timely, approved communications to regulators, customers and other affected parties.
Oversee managed security service performance, escalation procedures and coverage, and verify appropriate follow-through on alerts, investigations and corrective actions.
Serve as a primary security contact for examinations, internal and external audits, and independent assessments; coordinate evidence, responses and remediation tracking.
Partner with Compliance and Risk Management to align the security program with banking requirements, FFIEC guidance and recognized frameworks such as NIST CSF.
Support vendor management through security due diligence, review of assurance reports and testing results, assessment of access and data handling, and ongoing monitoring of critical providers.
Ensure independent testing and audit activities remain separate from the design and operation of the controls being assessed.