Chief Information Security Officer

All Jobs >
Chief Information Security Officer

The Chief Information Security Officer (CISO) is responsible for establishing, leading, and continuously advancing Cor Serv’s information security and cybersecurity program. The CISO will own the company’s information security strategy, governance, risk management, security architecture, incident preparedness, and security compliance program.

The role requires a hands‑on approach to the implementation, operation, and continuous improvement of the technologies, controls, and processes required to protect the organization and its clients.

• Establish a cybersecurity governance framework aligned with business objectives, regulatory requirements, client expectations, and industry best practices.
• Establish security priorities and a security roadmap based on business risk, evolving technology requirements, and emerging threats; advise on risks, vulnerabilities, threats and recommended mitigation strategies.
• Lead enterprise cybersecurity risk assessments and ensure identified risks are appropriately documented, prioritized, remediated, or accepted.
• Maintain a security program aligned with applicable frameworks and standards, including PCI DSS, SOC 2, and relevant banking and financial institution requirements.
• Oversee activities required to maintain PCI and SOC compliance, including, but not limited to, security awareness training, weekly security scan reviews, and recurring monthly, quarterly, and annual compliance activities.
• Provide security leadership and oversight for regulatory examinations, client audits, penetration testing, vulnerability assessments, and third‑party security reviews, and participate directly in the evaluation and remediation of significant findings.
• Oversee security due diligence and third‑party cybersecurity risk management, including responses to vendor and partner requests, as well as ongoing monitoring of critical vendors.
• Provide oversight of security architecture across applications, APIs, databases, networks, cloud environments, identity systems, endpoints, and third‑party integrations.
• Establish security architecture principles and standards supporting confidentiality, integrity, availability, resilience, and scalability.
• Ensure effective operation of security technologies and controls including firewalls, intrusion detection and prevention, endpoint security, encryption, data loss prevention, file integrity monitoring, vulnerability management, and security monitoring.
• Ensure effective identity and access management controls, including privileged access, authentication, authorization, MFA, and periodic access reviews.
• Establish and oversee a comprehensive vulnerability management program across infrastructure, applications, endpoints, and other technology assets including internal and external scanning, penetration testing, remediation tracking, and risk‑based prioritization.
• Oversee security monitoring and detection capabilities designed to identify unauthorized activity, anomalous behavior, and emerging threats.
• Partner with Technology, Network Operations, and Development teams to ensure vulnerabilities are remediated within established risk‑based timelines.
• Own the cybersecurity incident response program and ensure documented plans, roles, escalation procedures, and communication protocols are maintained and regularly tested.
• Promote a security‑conscious culture and ensure employees understand their responsibilities for protecting company and client information.

• 10+ years of progressive experience in information security, cybersecurity, infrastructure security, security engineering, or related disciplines.
• Strong knowledge of cybersecurity governance, risk management, security architecture, incident response, vulnerability management, and security operations.
• Deep understanding of NIST cybersecurity frameworks, PCI DSS, and SOC 2.
• Hands‑on experience with data protection, encryption, DLP, identity and access management, endpoint security, firewalls, intrusion detection/prevention, and security monitoring technologies.
• Experience working with external auditors,…