Information Security Officer

Richwood Bank•Richwood, OH

About The Position

The Information Security Officer (ISO) leads Richwood Bank’s information security program to protect customer and employee information, preserve the confidentiality, integrity and availability of bank systems, and support secure banking operations. The role combines program leadership with practical oversight of security operations, risk management, policies, architecture and employee awareness. The ISO directs assigned security personnel and coordinates managed security providers, incident response partners and virtual CISO resources, as applicable. The role works closely with systems and network teams, Compliance, Risk Management, Human Resources and business leaders to implement safeguards and communicate security priorities in business terms. Richwood Bank expects all team members to be active and engaged participants in its culture. The position develops and maintains a risk-based security program; oversees security architecture, policies, assessments, awareness, operational controls and incident response; and reports risks and remediation progress to senior management and appropriate board committees. It also supports audits, regulatory examinations, third-party risk management, business continuity and disaster recovery, and the evaluation and deployment of security solutions.

Requirements

Bachelor’s degree in information security, information technology, computer science or a related field, or an equivalent combination of relevant education and professional experience.
At least five years of progressive experience in information security or IT risk, including responsibility for security program activities, incident response or control oversight.
Experience coordinating security initiatives across teams and managing external security providers or comparable service relationships.
Working knowledge of security risk assessments, vulnerability management, identity and access controls, endpoint protection, network security, cloud security and incident response.
Ability to develop practical policies, interpret assessment findings, prioritize remediation and maintain clear documentation.
Strong judgment, organizational skills and ability to explain security risks and recommendations to business leaders.
Strong decision-making skills, including weighing the relative costs and benefits of potential actions.
Ability to influence others to modify opinions, plans or behaviors.
Understanding of organizational mission, values and goals, and consistent application of this knowledge.
Strong problem-solving, critical thinking and troubleshooting skills.
Ability to establish and maintain effective working relationships and exercise independent judgment.
Excellent analytical, mathematical and creative problem-solving skills.
Excellent listening, interpersonal, written and oral communication skills.
Logical and efficient approach with keen attention to detail.
Highly self-motivated and directed.
Ability to prioritize and execute tasks effectively under pressure.
Strong customer service orientation.
Experience working in a team-oriented, collaborative environment.
Candidates are subject to background and credit checks; employment is contingent upon results that meet company standards and applicable laws.

Nice To Haves

Experience in a community bank, financial institution or other regulated environment, including participation in audits or regulatory examinations.
Knowledge of GLBA information security requirements, FFIEC guidance, NIST Cybersecurity Framework and third-party risk management practices.
CISSP, CISM, CRISC or a comparable information security certification.
Experience supervising staff or leading an information security program, including management and board reporting.
Experience with Microsoft 365 and Entra ID, endpoint detection and response, SIEM or managed detection services, privileged access management, firewalls, secure remote access and recovery technologies.

Responsibilities

Develop, maintain and measure a risk-based information security program aligned with the bank’s business objectives, risk appetite and applicable requirements.
Maintain security architecture, standards and control baselines with systems, network and application owners, and incorporate security into technology projects and changes.
Create and maintain information security policies, standards, guidelines and procedures, coordinating approval, communication, periodic review and documented exceptions.
Lead information security risk assessments, maintain a risk register, and recommend prioritized remediation plans with accountable owners and target dates.
Develop and maintain the security awareness program, including onboarding, recurring training, phishing exercises and role-specific education.
Partner with business continuity and IT recovery owners to maintain and test continuity and disaster recovery plans, especially for cyber incidents, data restoration and critical banking services.
Report security risks, incidents, control effectiveness and remediation progress to senior management, the IT Steering Committee and the board or designated board committee.
Maintain an escalation path for significant risks and unresolved findings, including independent escalation to the designated executive or board committee when needed.
Recommend security priorities, staffing, training and budget needs; present risk treatment options and obtain documented risk acceptance from authorized management.
Monitor emerging threats, attack methods, security technologies and financial services risks, and recommend practical improvements appropriate to the bank’s size and complexity.
Evaluate and recommend security solutions through approved procurement and vendor management processes, considering effectiveness, integration, support and total cost.
Oversee deployment, integration, configuration and validation of security solutions with IT teams and service providers.
Review new systems, cloud services, digital banking integrations, automation and AI use cases for security and data protection risks before implementation.
Oversee monitoring and protection of endpoints, servers, networks, cloud services, email, identities and data repositories through internal resources and managed providers.
Coordinate identity and access management, multifactor authentication, privileged access, remote access, encryption and data protection controls, and oversee periodic access reviews.
Oversee vulnerability scanning, penetration testing and security assessments; prioritize findings, coordinate remediation with system owners and verify closure.
Monitor adherence to security policies and configuration standards, track exceptions and coordinate corrective actions.
Lead responses to suspected or confirmed information security incidents, coordinating investigation, containment, recovery, evidence preservation and lessons learned.
Maintain and exercise the incident response plan, coordinating escalation and communications with leadership, Compliance, legal counsel, insurers and response providers as appropriate.
Work with Compliance and legal counsel to assess notification obligations and support timely, approved communications to regulators, customers and other affected parties.
Oversee managed security service performance, escalation procedures and coverage, and verify appropriate follow-through on alerts, investigations and corrective actions.
Serve as a primary security contact for examinations, internal and external audits, and independent assessments; coordinate evidence, responses and remediation tracking.
Partner with Compliance and Risk Management to align the security program with applicable banking requirements, FFIEC guidance and recognized frameworks such as NIST CSF.
Support vendor management through security due diligence, review of assurance reports and testing results, assessment of access and data handling, and ongoing monitoring of critical providers.
Ensure independent testing and audit activities remain separate from the design and operation of the controls being assessed.