Information Security Officer

The Information Security Officer (ISO) is responsible for developing, executing, and managing the bank’s information security program to ensure compliance with GLBA, FFIEC, and other applicable federal and state regulatory requirements. This includes management of cybersecurity risks, business continuity, third party risk, and data governance, working with business units to maintain a secure operating environment.

• Governance &
  
  Risk Management:
• Oversee the bank’s information security program, ensuring accountability and alignment with strategic plans, business objectives, regulatory requirements, and industry best practices.
• Evaluate the design and effectiveness of information security controls and recommend improvements.
• Conduct periodic cybersecurity, vendor and IT risk assessments to identify vulnerabilities and threats to the bank’s information assets and operations.
• Monitor and analyze security incidents and implement risk mitigation measures.
• Oversee data governance to ensure data quality, integrity, accessibility, security, and regulatory compliance throughout its lifecycle.
• Deliver quarterly reports to Audit, Risk and Compliance (ARC) Committee and Board on security posture, emerging risks, and updates across all areas of responsibility.
• Regulatory Compliance:
• Ensure compliance with FFIEC, GLBA, NIST, PCI DSS, and other applicable regulations.
• Monitor regulatory changes and implement required updates promptly.
• Work with audit and risk teams on audit/exam preparation, providing documentation and expertise while preserving audit independence.
• Coordinate management responses and remediation plans, ensuring timely resolution and clear communication.
• Cybersecurity:
• Coordinate with IT to implement and maintain effective security tools and cybersecurity measures.
• Monitor and respond to alerts, incidents, vulnerabilities, and emerging threats—including AI‑related risks—and adjust controls as needed.
• Continuously evaluate and recommend improvements to security technologies to strengthen the bank’s cybersecurity posture.
• Lead the investigation and documentation of security incidents and cyber events.
• Business Continuity (BCP) and Disaster Recovery (DR):
• Maintain the bank’s BCP/DR programs, updating plans as technology, processes, and threats change.
• Lead testing and tabletop exercises, ensuring corrective actions are completed.
• Serve as BCP Coordinator, ensuring the Committee follows required schedules.
• Lead BCP/DR activities and communication during operational disruptions.
• Report DR‑related incidents to regulators as required.
• Incident Response and Recovery:
• Maintain the incident response plan with clear procedures for security events.
• Lead response efforts with IT, legal, and senior management to contain, investigate, and recover from incidents.
• Third-Party
  
  Risk Management:
• Oversee third‑party risk management, including policies, due diligence, and ongoing security assessments.
• Evaluate the security posture of new and existing vendors for compliance with bank standards.
• Provide reminders to management regarding TRPM responsibilities.
• Security Awareness and Training:
• Develop and conduct ongoing information security and cybersecurity training for all staff.
• Participate in information‑sharing groups (e.g., Infra Gard, FS‑ISAC, TBA ISAO) to stay current on threats and best practices.
• Ensure annual training for employees, management, the board, and security personnel.
• Promote a strong culture of security awareness across the bank.
• Conduct phishing simulations and use results to guide training needs.

• BBA in business (CIS related major), BS in computer science, or equivalent degree.
• Relevant certification (i.e. CISSP, CISA, etc.) highly preferred; or willing to work towards certification.
• Preferably 8+ years of experience in information security, cybersecurity, IT audit, or a related field within the banking, financial services, or similarly regulated industry.
• Thorough understanding of FFIEC IT Examination Guidelines, and other related industry standards (GLBA, NIST, PCI, etc.).
• Excellent communication and people skills are a must:
• Ability to interact and cooperate with all levels…