Application Security Program Manager -II

The Application Security Program Manager provides leadership and governance for the bank’s application security, identity management, fraud-related technology risk, and emerging technology risk programs within the Information Security Program. This role establishes standards, risk assessment methodology, reporting, and a multi-year roadmap, coordinating with Technology and business leaders to align security expectations with regulatory requirements and business objectives.

• Location: Honolulu, HI (onsite)
• Compensation: USD 86, per year

• Develop and maintain information security risk management processes that are clear, workable, up to date, and reflect regulatory and bank-specific requirements and issues.
• Assist with communicating risk management processes across the business, including training sessions where appropriate.
• Plan, coordinate, implement, and manage security measures that address risks to systems and data, including preventing unauthorized modification, destruction, or disclosure of information, including by outsider service providers.
• Analyze and evaluate new products and systems for security weaknesses, and provide measures to prevent exposure and loss.
• Train staff on policies and standards related to application security and identity management best practices, including methodologies for conducting related risk assessments.
• Review and delegate work tied to governance and oversight of controls for application security and identity management.
• Lead and motivate a team to support engagement, performance, and productivity, including setting goals and providing guidance.
• Conduct regular performance reviews, provide constructive feedback, identify skills gaps, and support professional growth through training, mentorship, or cross-functional collaboration.
• Lead a risk-based application security review program to ensure appropriate security controls are designed, implemented, and operating effectively.
• Validate application and related reference architectures for security best practices and recommend changes to enhance security and reduce risk where applicable.
• Oversee application risk assessments and control reviews, identify weaknesses, and drive remediation plans with accountable stakeholders.
• Lead security risk evaluations for emerging technologies, new business initiatives, and material changes to the application and identity ecosystem.
• Conduct or facilitate threat modeling for services and applications, linked to associated risk and data.
• Provide strategic oversight for application security tooling, processes, and service models to support scalable coverage and risk visibility.
• Conduct incident response exercises and incorporate lessons learned into existing security architectures and practices.
• Conduct forensic analysis of security-related incidents in a manner consistent with best practices and counsel.
• Perform risk analyses for the bank’s security needs and prepare recommendations based on risk and exposure versus cost.
• Prepare and deliver research findings in written and/or oral form, including presenting objectives, alternatives, risk analyses, and cost/benefit analyses.
• Assist with planning and directing information security activities to support compliance with internal and external audits and federal and State regulations, including FDIC, relevant sections of the Gramm-Leach-Bliley Act (GLBA), Sarbanes-Oxley Act Section 404 provisions, and other duties as assigned.
• Maintain an outward-facing, forward-looking view to ensure the Information Security Program remains current and relevant.
• Design, implement, and manage Information Security data identification, aggregation, analytics, and validation to meet department goals.
• Collaborate on…