Information Security Risk Officer

Hudson Valley Credit Union•Poughkeepsie, NY

About The Position

Hudson Valley Credit Union is recruiting an Information Security Risk Officer (ISRO) to provide leadership, direction, and coordinated oversight across third-party risk management (TPRM), HIPAA and privacy, artificial intelligence risk, and threat analysis. The ISRO establishes accountability and decision rights, integrates risk information across these areas, independently challenges risk decisions, escalates material concerns, and provides decision-ready reporting to management and governance committees. The role partners with second-line functions—including Cybersecurity Governance and Risk, Enterprise Risk Management, Legal and Compliance, Data Governance, and AI Governance—and coordinates with first-line functions such as Information Assurance, business lines, Technology, and Procurement, as well as Third Line Internal Audit. The position helps protect member and organizational information, strengthen operational resilience, and support regulatory and examination readiness. The ISRO provides oversight of cybersecurity and technology controls, policy exceptions, risk acceptances, third-party risk activities, HIPAA and privacy risks, AI use cases, and threat analysis. The role also translates complex technical and risk matters into clear business communications for leaders, committees, auditors, and examiners; maintains knowledge of relevant threats, technologies, laws, regulations, supervisory expectations, and industry practices; and adheres to Credit Union policies, regulatory requirements, training, and guiding principles.

Requirements

Bachelor’s degree in a related technical, law, or security field, such as Computer Science or Information Technology, or equivalent.
At least 5 years of leadership experience.
At least 10 years of progressive experience in cybersecurity governance, enterprise risk management, HIPAA and privacy, control assurance, audit and examination readiness, and regulatory compliance within financial services or another highly regulated environment.
CISSP, SSCP, CISM, and CEH are listed as required.

Responsibilities

Lead and coordinate Cybersecurity Governance & Risk responsibilities assigned to the ISRO function, including TPRM liaison, HIPAA and privacy, artificial intelligence risk, and threat analysis.
Establish expectations, priorities, decision rights, escalation paths, service levels, and performance measures for aligned functions; provide independent, risk-based oversight and effective challenge of cybersecurity and technology risk decisions.
Evaluate control design and operating effectiveness across business processes, information systems, cloud services, data environments, third parties, AI use cases, and critical technology changes.
Coordinate cybersecurity policy exceptions and risk acceptances, including business justification, compensating controls, approval, expiration, and periodic reassessment.
Consolidate risk themes, trends, exceptions, issues, remediation status, audit and examination matters, and emerging concerns into management and governance committee reporting.
Provide cybersecurity risk leadership and functional direction for third-party risk activities, including risk tiering, due diligence, contract security requirements, assurance review, ongoing monitoring, issue management, risk acceptance, renewal, and termination.
Partner with relevant stakeholders to integrate cybersecurity, privacy, resilience, and data protection requirements throughout the third-party lifecycle.
Monitor third-party and fourth-party findings, control changes, incidents, concentration risk, cloud risk, service resilience, and remediation commitments; escalate risks outside approved tolerance and produce metrics, portfolio insights, and examination-ready evidence.
Coordinate oversight of HIPAA and privacy-related cybersecurity risks, including assessments for systems, business processes, third parties, data sharing, cloud services, and change initiatives involving protected, confidential, or regulated information.
Partner with Legal, Compliance, Data Governance, Technology, Incident Response, business owners, and third parties on privacy-by-design, minimum-necessary access, data lifecycle safeguards, incident and breach assessment support, control requirements, and evidence readiness.
Lead AI risk oversight and represent cybersecurity risk in enterprise AI Governance and Data Governance activities, including expectations for intake, inventory, tiering, assessment, approval, testing, documentation, monitoring, exceptions, and escalation.
Coordinate with cybersecurity operations, incident response, fraud, IT, Enterprise Risk Management, business continuity, third-party risk, and other stakeholders to validate threats, align response priorities, and avoid duplicative operational responsibilities.
Communicate complex technical, privacy, third-party, AI, and threat information in clear business terms for leaders, committees, auditors, and examiners.
Maintain current knowledge of evolving threats, technologies, laws, regulations, supervisory expectations, and industry practices relevant to assigned functions.
Assess and communicate AI risks involving security, privacy, data quality, intellectual property, explainability, transparency, bias or harmful outcomes, output reliability, human oversight, misuse, prompt injection, data leakage, model drift, third-party dependency, and operational resilience.
Direct threat analysis so relevant internal and external threat information informs governance, risk assessments, control assurance, third-party oversight, strategic planning, executive reporting, and remediation priorities.
Oversee analysis of threat actors, tactics, techniques, procedures, vulnerabilities, attack trends, fraud and social-engineering patterns, geopolitical or sector developments, and emerging technology risks relevant to the Credit Union.
Translate threat analysis into risk scenarios, control priorities, assessment focus areas, tabletop or exercise inputs, awareness topics, and remediation recommendations; escalate credible or material threat developments when changes to risk treatment, monitoring, resilience, or governance are warranted.
Follow Credit Union policies, procedures, and regulatory agency requirements; participate in required and recommended training and development, including BSA training, and demonstrate attained knowledge.
Participate on Credit Union teams, projects, and strategic initiatives when opportunities arise; perform additional duties and special projects as assigned.
Apply HVCU’s guiding principles, including its Mission, Vision, Core Values, Employee and Member Value Propositions, Sales and Service Model, and commitment to Lean Six Sigma practices; support initiatives through teamwork and professionalism.
Maintain regular and predictable attendance, including punctuality.