Information Security Operations

CONNEX CREDIT UNION INC•North Haven, CT

11d•$104,616 - $156,923•Onsite

About The Position

The Information Security Operations Leader is a hands-on leadership role responsible for designing, planning, budgeting, securing, monitoring, and integrating cybersecurity initiatives across Connex Credit Union. The role aims to strengthen cybersecurity capabilities and incident response processes while ensuring they meet organizational requirements and applicable industry standards. It safeguards information systems and data assets by implementing and maintaining measures that protect confidentiality, integrity, and availability. The position manages cybersecurity projects and vendor responsibilities, supports the Risk Management Framework (RMF), and oversees risk assessments, security controls, vulnerability analysis, penetration testing, audits, and incident response. It also develops security policies and awareness programs, monitors threats, investigates fraud and security incidents, supports regulatory compliance, evaluates third-party security, and reports on cybersecurity and compliance to executive management and the board. The role collaborates with internal and external stakeholders and helps integrate security into systems and development processes.

Requirements

Bachelor’s or master’s degree in Information Security, Computer Science, or equivalent education and appropriate work experience.
Industry-recognized certification such as CISSP, CISM, or CISA.
At least 5–8 years of relevant experience.
Proven experience as an Information Security Engineer or in a similar role.
Proven experience in a leadership role in information security.
Strong knowledge of information security principles and best practices.
Knowledge of threat and vulnerability analysis, penetration testing, and red-team/blue-team exercises.
Experience with security technologies, including firewalls, IDS/IPS, antivirus, and encryption.
Familiarity with security frameworks and compliance standards such as ISO 27001, NIST, and GDPR.
Hands-on experience with security tools and technologies.
Strong understanding of banking or credit union operations, regulatory requirements, and financial procedures.
In-depth knowledge of cybersecurity technologies, tools, and best practices.
Experience evaluating and managing cyber risk and working within industry-standard frameworks such as the NIST Cybersecurity Framework, CIS Top 20, and NIST 800-XX.
Knowledge of methodologies such as the Cyber Kill Chain and Diamond Model of Intrusion Analysis.
Mandatory experience with cloud computing, networks, servers, operating systems, and PCs.
Excellent communication, teamwork, and leadership skills.
Ability to learn quickly and adapt to new technologies, methodologies, and a dynamic environment.
Exceptional attention to detail and ability to work accurately.
Collaborative mindset and willingness to work with colleagues toward shared goals.
Ability to make critical decisions under pressure and solve complex analytical or project-related problems.
Ability to lift boxes weighing up to 50 pounds.

Nice To Haves

Experience with ATM/ITM networks.

Responsibilities

Deliver cybersecurity initiatives and coordinate with internal teams and external vendors to test the credit union’s cybersecurity resilience.
Oversee audits and evaluations of the cybersecurity environment.
Plan, document, test, integrate, and execute cybersecurity projects, including annual budgeting and vendor coordination.
Conduct risk assessments, analyze security controls, and recommend improvements.
Assist in developing and maintaining Risk Management Framework (RMF) processes and documentation; collaborate to assess, document, and authorize information systems using the RMF.
Develop and implement information security policies, procedures, standards, and guidelines.
Monitor and defend systems against cyber threats; detect, analyze, and respond to security incidents and improve the organization’s security posture.
Conduct regular vulnerability assessments and penetration tests on IT infrastructure, applications, and networks; report findings and assist with remediation.
Monitor security logs, proactively search for threats and vulnerabilities, and coordinate incident handling and response.
Ensure cybersecurity activities comply with applicable government policies, standards, and requirements relevant to national security systems and related regulatory requirements.
Collaborate with IT and development teams to integrate security into system design and implementation.
Maintain accurate records of activities, findings, actions, and recommendations; contribute to cybersecurity exercise reports and documentation.
Stay informed about security threats, technologies, trends, and best practices.
Conduct security awareness training and oversee programs for employees, members, and stakeholders.
Design and implement security controls for networks, systems, and applications.
Conduct risk assessments and vulnerability scans, develop mitigation plans, and safeguard the organization against cyber threats and vulnerabilities.
Investigate and mitigate business fraud.
Create and maintain an incident response plan to support timely recovery from breaches and disruptions.
Investigate security incidents and conduct research and forensics with internal teams and external vendors.
Evaluate and monitor security practices of third-party vendors, partners, and service providers.
Collaborate with internal and external stakeholders to support security standards and trade compliance.
Provide regular cybersecurity and compliance reports and updates to executive management and the board of directors.
Establish reasonable project and task timeframes and complete work within them; achieve clean audits or audit resolutions within departmental service metrics.
Maintain service desk responses within departmental service metrics and support clean annual disaster recovery testing and timely disaster response.
Oversee day-to-day cybersecurity projects, tools, technologies, and vendors, and respond to incidents and issues promptly and thoroughly.
Anticipate system and network risks and ensure adequate safeguards.
Work collaboratively and effectively with other teams and departments.
Be available on call after hours.