Information Security Officer
About The Position
The Information Security Officer leads the development, implementation, and ongoing oversight of the Bank’s Information Security and Vendor Management Programs. Reporting to the Chief Risk Officer, this role safeguards systems and non-public information by identifying and addressing security risks, maintaining regulatory alignment, coordinating technology-related audits and examinations, and keeping Senior Management and the Board of Directors informed. The Officer promotes organization-wide security awareness and works closely with Information Technology, business leaders, auditors, regulators, vendors, customers, and other external partners. This is a primarily office-based position involving prolonged sitting and computer use, regular use of standard office equipment, and occasional physical activities including standing, walking, reaching, stooping, kneeling, and lifting or moving items up to 20 pounds. The role also requires the ability to travel by car and provide on-call availability. There are no direct reports.
Requirements
- Bachelor’s degree in Computer Science, Management Information Systems, Cybersecurity, or a related field; equivalent applicable information security experience may be considered.
- At least five years of risk management experience, including experience assessing networking, hardware, software, information security, and vendor risks.
- Basic understanding of information technology auditing procedures.
- Strong knowledge of information security, cybersecurity, technology risk management, networking, hardware, software, and data-protection practices.
- Working knowledge of technology auditing procedures, regulatory examination support, vendor risk management, business continuity, and recognized security frameworks.
- Ability to analyze complex technical and business issues, exercise sound judgment, anticipate emerging risks, and recommend practical solutions.
- Excellent written and verbal communication skills, including the ability to explain security concepts clearly to audiences at all levels and to external stakeholders.
- Strong policy development, program management, reporting, presentation, collaboration, and organizational skills.
- Proficiency with Microsoft Office applications.
- Ability to handle confidential organizational information and sensitive non-public personal information with discretion.
- Regular attendance and on-call availability are essential functions of the position.
Nice To Haves
- CISSP, CISA, CISM, or a comparable certification.
- Familiarity with endpoint security solutions, vulnerability management tools, and security monitoring technologies.
Responsibilities
- Develop, implement, monitor, and continuously improve the Bank’s Information Security and Vendor Management Programs, including related policies, procedures, standards, guidelines, and templates.
- Conduct information technology, cybersecurity, and vendor risk assessments; review technology risks identified by business lines; and perform business impact analyses aligned with the Business Continuity Plan and Vendor Risk Management Program.
- Identify and evaluate information and cybersecurity threats using assessment methods such as FFIEC CAT and RSAT, and evaluate the security program against frameworks such as NIST.
- Manage and oversee user entitlement reviews, network-use monitoring, outsourced penetration testing, vulnerability remediation, and the Bank’s Data Life Cycle program through secure destruction of non-public data.
- Develop dashboards and reports demonstrating program performance, and present assessment results and program status to committees, Senior Management, and the Board of Directors.
- Promote a culture of information security through onboarding, awareness communications, phishing-campaign follow-up, and education for employees, customers, and the Board, as appropriate.
- Serve as the focal point for technology-related audits and regulatory examinations by supporting planning, coordinating requested documentation, recording responses, and tracking remediation of findings.
- Monitor applicable state and federal requirements, including the Connecticut Data Privacy Act and GLBA, and recommend updates based on regulatory changes and industry best practices.
Benefits
- Medical insurance
- Prescription drug coverage
- Dental insurance
- Vision insurance
- AFLAC supplemental coverage
- Health Savings Account with employer contribution
- Flexible Spending Accounts for medical and dependent care
- Paid vacation, personal time, sick time, birthday day off, floating holiday, and short-term disability for full-time and benefit-eligible employees
- Paid vacation and personal time for part-time employees working 20–30 hours
- Company-paid life insurance
- Company-paid AD&D insurance
- Employee Assistance Program for counseling, financial, legal, and family support
- 401(k) plan
- 4% automatic company contribution
- 50% match on the first 8% contributed
- Potential annual profit-sharing contribution
- Virtual medical visits
- Wellness programs
- Behavioral health support
- Wellness rewards program
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
