Vice President, Information Security

PTMA is an SEC-registered investment adviser serving governments, school districts, and public agencies across treasury management, cash and liquidity management, and investment advisory services. Our clients trust us with public funds and sensitive financial data, and we treat protecting that trust as a core business obligation. We are a firm of about 300 people with a technology organization spanning Information Security, Data & AI, Salesforce, and Corporate IT.

The firm’s primary operational hubs are in Denver, Colorado, and Naperville, Illinois, with other offices throughout the United States.

The VP, Information Security is PTMA's senior security executive and owns our information security program end to end. This leader sets security strategy, runs day-to-day security operations through an in-house team and managed service partners, commands incident response, and represents the program to the executive team, the board, regulators, auditors, and clients.

The role reports to the Chief Information, Data & AI Officer, with a dotted line to the General Counsel and Chief Compliance Officer and a documented right to escape directly to the CEO and board. That structure gives security the authority to challenge technology decisions as a peer of IT, not a subordinate to it.

We are looking for a builder. Our controls, tooling, and incident response roadmap are in place and maturing. The VP will turn that foundation into a measurable, exam-ready program that scales with our growth and our expanding use of data and AI.

• Own the information security strategy, multi-year roadmap, and annual budget, aligned to PTMA's business and technology plans.
• Run the firm's cyber risk assessment cycle, maintain the risk register, and present risk acceptance decisions to executive leadership.
• Report program health, top risks, and incidents to the executive team and the board on a regular cadence, in business terms.

• Maintain the written information security program, policies, and standards, and keep them current with regulatory change.
• Lead security readiness for SEC examinations, internal and external audits, client due diligence questionnaires, and cyber insurance renewals.
• Own compliance of security controls with SEC Regulation S-P (including incident response and customer notification requirements), SEC Rule 204-2 recordkeeping, and PCI DSS where applicable.
• Partner with Legal and Compliance on regulatory interpretation, breach notification decisions, and client contract security terms.

• Serve as incident commander for security incidents, from detection through containment, notification, and post-incident review.
• Complete and maintain our incident response playbook library, and run tabletop exercises with technical teams and executive leadership.
• Manage managed detection and response and other security service providers to defined service levels.
• Own log management and SIEM retention, vulnerability management, and threat intelligence programs.

• Own the security technology stack across endpoint, email, identity, cloud security posture, network, and secure access service edge.
• Set security requirements for cloud, SaaS, and data platform initiatives, including Microsoft 365, Azure, Microsoft Fabric, and Salesforce.
• Define security and privacy controls for AI adoption in partnership with the Data & AI team and the firm's AI governance council.
• Run third-party and vendor risk assessments for technology providers.

• Lead, develop, and grow the information security team, with clear career paths and development plans.
• Run security awareness training and…