Senior Information Risk Officer

Columbia Bank•Spokane, WA

11h•Onsite

About The Position

The Senior Information Risk Officer leads information governance, risk, and compliance efforts. The role establishes and maintains risk management, monitoring, and validation activities; facilitates development of relevant policies and standards; and maintains governance documentation describing how information should be secured, including internal process and procedure documentation. The officer conducts formal risk assessments and self-assessments for key processes and technologies, using industry standards such as CIS, ITIL, and COBIT to develop a program for Columbia Bank. The role analyzes technology and security controls for compliance with documented and approved standards and ensures information systems and vendors comply with company policies, standards, and procedures. The officer advises technology teams and business units on compliance readiness, tracks and monitors gaps in key Bank risk programs, maintains gap analysis documents, and gathers information from technology teams and lines of business to identify improvement opportunities. The role identifies new assets and vendors and oversees their risk evaluations and risk rankings. It liaises with technology leaders and corporate risk and operational groups—including TPO, TAG, Internal Audit, Corporate Compliance, Enterprise Risk Management, and Legal—to support alignment and meet obligations. The position requires compliance with applicable Bank regulations, policies, procedures, and required training, and keeping current with regulatory changes. It includes maintaining working knowledge of the Bank’s written policies and procedures concerning the Bank Secrecy Act, Regulation P, Regulation CC, Regulation E, Bank Security, and other applicable regulations. The officer may coach, mentor, or train others and teach coursework as a subject matter expert. The role also involves fostering Columbia’s corporate culture, taking initiative, supporting the Bank’s vision and strategic direction, and performing other duties as assigned. This position is fully onsite at 111 N Wall St Building, Spokane, WA 99201. Occasional travel is required. The stated pay range is $92,196,000.00–$115,000.00; pay is dependent on factors including job-related knowledge, skills, experience, education, and geographic location. The role may be eligible for performance-based incentive compensation.

Requirements

7–10 years of experience in, or a combination of, information security, IT audit, or information technology operations.
Knowledge of risk management processes, including information security management.
Experience evaluating controls against information security frameworks such as ISO 27002, NIST 800 series, or financial services regulatory frameworks such as FFIEC IT booklets and the Cybersecurity Assessment Tool (CAT).
Knowledge of systems and network concepts, including access, authorization, configuration, and design.
Demonstrated understanding of information security concepts, including encryption, access controls, network security, security operations, security architecture, threat modeling, and design.
Knowledge of applicable regulatory requirements, including PCI DSS, GLBA, and HIPAA.
Ability to operate in a cross-functional environment and build and foster relationships with other departments and stakeholders.
Ability to anticipate and respond to changing priorities and work effectively in a dynamic, demand-based environment requiring flexibility and responsiveness.
Ability to work fully onsite at the posted location.
Occasional travel is required.

Nice To Haves

High school diploma or GED (preferred).
Bachelor’s degree in computer science or equivalent (preferred).
CISA, CRISC, CISSP, CISM, or SANS GIAC certification (such as GSNA).

Responsibilities

Lead information governance, risk, and compliance efforts.
Establish and maintain key risk management, monitoring, and validation activities.
Facilitate development of relevant policies and standards.
Maintain governance documentation describing how information should be secured, including internal process and procedure documentation.
Perform formal risk assessments and self-assessments for key processes and technologies, using industry standards such as CIS, ITIL, and COBIT.
Analyze internal technology and security controls to ensure compliance with documented and approved standards.
Ensure information systems and vendors in the Bank’s operating environment comply with company policies, standards, and procedures.
Provide advisory support and subject-matter expertise to technology teams and business units for compliance readiness.
Track and monitor gaps in key Bank risk programs and maintain gap analysis documents.
Gather information from technology teams and lines of business to identify areas for improvement in banking practices.
Identify new assets or vendors and oversee risk evaluation and risk ranking.
Liaise with technology leaders and corporate risk and operational groups, including TPO, TAG, Internal Audit, Corporate Compliance, Enterprise Risk Management, and Legal, to ensure alignment and meet obligations.
Comply with applicable Bank regulations, policies, procedures, and required training; keep up to date on regulatory changes.
Maintain working knowledge of Bank policies and procedures relating to the Bank Secrecy Act, Regulation P, Regulation CC, Regulation E, Bank Security, and other applicable regulations.
May coach, mentor, or train others and teach coursework as a subject matter expert.
Demonstrate and foster Columbia’s corporate culture, take initiative, and support the Bank’s vision and strategic direction.
Perform other duties as assigned.

Benefits

Eligible associates receive medical, dental, and vision coverage.
401(k) retirement savings plan with employer match for qualifying associate contributions.
Employee assistance program.
Life insurance.
Disability insurance.
Tuition assistance.
Mental health resources.
Identity theft protection.
Legal support.
Auto and home insurance.
Pet insurance.
Access to an online discount marketplace.
Paid vacation, sick days, volunteer days, and holidays.
The role may be eligible for performance-based incentive compensation.