Assistant Vice President, Deputy Chief Information Security Officer

Overview

Provides strategic leadership in the development of Western & Southern Financial Group's (WSFG) Information Security management program to support the business objectives of W&SFG. Leads the Information Security Risk Management and Identity & Access Management (IAM) teams. Additionally, ensures efficient, cost-effective operation, and oversees project development and implementation, in addition to normal managerial expectations. Works with minimal supervision and is responsible to independently make a broad range of critical decisions, escalating to executive-level associates only when appropriate.

What you will do:

• Directs Information Security Risk Management services for the Enterprise through effective and collaborative corporate governance structures, ensuring adherence to information security principles and corporate expectations. Coordinates resources in the assessment of information security risk and partnering with others in the Enterprise to provide guidance for risk treatment plans.
• Facilitates metrics and reporting on the efficiency and effectiveness of the Information Security Risk Management function. Provides regular reporting on the current status of information security risks to senior-level management.
• Leads the information security and risk management awareness training programs for all associates, contractors and authorized system users.
• Oversees third-party vendor due diligence security reviews to ensure compliance with information security policy, security procedures and regulatory requirements. Handles escalations from the team in reporting deficiencies or risks to the appropriate executive-level stakeholders in IT, the business and third parties. Partners with IT leadership and compliance teams to support process/program improvements.
• Develops and oversees the implementation of W&SFG's IAM strategy that is aligned with business priorities, industry best practices and the Information Security strategic plan. The desired end state is a single set of identities access the Enterprise in support of internal and external access needs.
• Ensures the successful delivery of IAM products and services required to meet business and technology requirements, which includes directory services (e.g., AD), identity federation (e.g., SAML, SSO, and ADFS), Multi-Factor Authentication (MFA), and Identity Management (IdM).
• Is responsible for the development and enforcement of company wide information security policies, standards and procedures within Information Security Risk Management and Identity and Access Management.
• Develops and manages the team's budget, monitors for variances and actively assists with the completion of the Information Security budget.
• Collaborate with IT in support of Disaster Recovery and Business Continuity.
• Manages and ensures timely completion of all assigned audit remediation work, internal projects and Portfolio level project deliverables.
• Recruits, hires, trains and develops management staff. Provides direction to and development to managers through coaching, the administration of the Performance Management Program, and the creation and implementation of development plans.
• Promotes development of management team and associates to ensure they are adequately trained to carry out their responsibilities and stay current on state-of-the-art technology.
• Potential on-call support during nights and weekends.
• Performs other duties as assigned.
• Complies with all policies and standards.

• Bachelor's Degree In information security, computer science or information technology, or commensurate selection criteria experience.
  
  - Required
• Minimum of 10 years of management level experience. Prefer experience in a combination of risk management, information security and IT-related positions.
  
  - Required
• Proven track record and experience in developing information security policies and procedures, as well as successfully executing programs that meet the objectives of excellence in a dynamic environment.
  
  - Required
• Demonstrated experience effectively influencing a group to a recommended course of action.
  
  - Required
• Proven experience in working with complex programs, which require identifying complex data and analyzing the quality of the output provided.
  
  - Required
• Demonstrated knowledge and understanding of relevant legal and regulatory requirements, such as New York Department of Financial Services Cybersecurity regulation, NAIC Data Security Model Law, and Health Insurance Portability and Accountability Act (HIPAA).
  
  -
• Demonstrated excellent verbal and written communication skills, interpersonal and collaborative skills with the ability to convey complex concepts and security and risk-related information to internal and external customers (technical and nontechnical) at all levels in a clear, accurate, focused and concise manner, and presentation style. Verbal and written communications are to conform to proper rules of punctuation, grammar, diction and style.
  
  -
• Proven leadership,…