SVP/Chief Information Security Officer

FourLeaf Federal Credit Union•Town of Oyster Bay, NY

1h•$300,000 - $330,000•Hybrid

About The Position

The Senior Vice President (SVP)/Chief Information Security Officer (CISO) is responsible for establishing, executing, and continuously enhancing the Credit Union’s enterprise-wide information security and cybersecurity program. The SVP/CISO provides strategic leadership and governance over information security, cyber risk management, threat intelligence, incident response, vulnerability management, third-party technology risk, and regulatory compliance. Working in close partnership with Second Line of Defense (2LOD) Risk Management and Compliance functions, the CISO ensures the Credit Union maintains a strong security posture that protects member information, critical business operations, and technology assets while enabling business growth and innovation.

Requirements

Bachelor’s Degree required
12+ years of progressive information security, cybersecurity, risk management, or technology leadership experience.
5+ years in a senior leadership role overseeing enterprise cybersecurity programs
Demonstrated experience managing security operations, incident response, vulnerability management, governance, risk, and compliance programs.
Experience overseeing third-party cyber risk and vendor security assessment programs
Computer Skills: Microsoft Office (Excel, Word, PowerPoint, Outlook, Teams), Security Information and Event Management (SIEM) Tools, Vulnerability Management Tools, Threat Intelligence Platforms, Identity & Access Management (IAM) Solutions, Cloud Security Platforms, Governance Risk & Compliance (GRC) Systems, Security Monitoring & Incident Response Tools.

Nice To Haves

Master’s degree preferred.
Certifications: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Cloud Security Professional (CCSP), Certified Ethical Hacker (CEH) or equivalent are all preferred.

Responsibilities

Develop, implement, and maintain the Credit Union’s enterprise information security strategy, framework, policies, and standards.
Implement and enforce enterprise security policies, procedures, and standards jointly developed with Second Line of Defense (2LOD) Risk Management and Compliance teams.
Ensure alignment of security practices with applicable regulatory requirements, industry standards, and Credit Union business objectives.
Provide regular reporting to executive management, Board committees, and regulators regarding cybersecurity risk, security posture, emerging threats, and remediation activities.
Establish and maintain information security governance processes, metrics, and key risk indicators.
Lead the Credit Union’s cybersecurity operations program, ensuring effective protection of information assets and infrastructure.
Oversee enterprise threat detection, threat intelligence, security monitoring, incident response, and vulnerability management activities.
Ensure timely response to security events and coordinate communication, recovery, and post-incident reviews.
Oversee penetration testing, vulnerability assessments, security monitoring tools, and remediation programs.
Own and manage the cybersecurity vendor risk assessment process for third-party service providers, fintech partners, and technology vendors.
Evaluate and monitor the security posture of third-party technology relationships throughout the vendor lifecycle.
Collaborate with Procurement, Legal, Information Technology, and Risk Management to ensure appropriate cybersecurity due diligence and contractual protections.
Review vendor security controls, independent audit reports, penetration test results, and other security attestations.
Ensure ongoing monitoring and remediation of identified vendor security risks.
Partner with 2LOD teams to identify, assess, monitor, and mitigate information security and cyber risks.
Support enterprise risk management initiatives by providing subject matter expertise on cyber and technology risks.
Ensure compliance with NCUA guidance, FFIEC cybersecurity expectations, GLBA, state privacy requirements, and other applicable regulatory standards.
Track and report remediation of audit findings and risk issues.
Provide leadership and direction to information security personnel and external security partners.
Foster a culture of cybersecurity awareness and accountability across the organization.
Collaborate with Information Technology, Operations, Digital Banking, Enterprise Risk, Compliance, Internal Audit, and business line leaders to integrate security into business processes and technology initiatives.
Advise senior management on security implications of strategic initiatives, digital transformation efforts, and emerging technologies.
Oversee security awareness education and training programs for employees and stakeholders.