SVP III, Chief Information Security Officer

Position Summary

Ensuring the security of millions of card members is our most important priority. The CISO balances this against the need to innovate and advance business capabilities and is an enabler, solutions provider, and trusted partner for various business and department leaders.

Ensuring the security of millions of card members is our most important priority. The CISO balances this against the need to innovate and advance business capabilities and is an enabler, solutions provider, and trusted partner for various business and department leaders.

The CISO is responsible for the bank’s Information Security Management Program including Governance, Risk Management, Threat Intelligence, and Assurance. The CISO chairs the Information Security Committee and partners with Information Technology leadership on Security Operations.

Information security responsibilities will include, but may not be limited to, data protection, mobile and endpoint security, threat detection, vulnerability management, application security architecture, identity and access management, cyber resiliency, network security architecture, information security policy, including network access and monitoring policies, employee education, etc.

We’re looking for an intelligent, articulate, and persuasive leader who can serve as an effective member of the senior management team and who is able to communicate security-related concepts to executives and a broad range of technical and non-technical staff. The ideal candidate will be a strategic thinker, looking at new and emerging threats and getting ahead of them; advancing new techniques and industry best practices.

The CISO is the information security subject matter expert and is expected to contribute guidance and expertise on a wide range of business topics including, but not limited to, information technology and information security policy, enterprise and technology risk management, data privacy, data governance, emerging technology and new and emerging threats.

• Design/improve security practices for existing and new technology capabilities to manage security vulnerabilities, including legacy banking systems, third-party applications, as well as newer architectures (cloud, etc.)
• Overall accountability to develop, implement, and maintain the information and cyber security management program, including security policy, standards, guidelines, and procedures.
• Periodically update the cyber security strategy to incorporate new technology and manage new & emerging threat information
• Manage the information security budget, including roadmap and delivery of security initiatives
• Stay current on technological change to understand the evolving security threat landscape, and ways to manage risks
• Ensure information security compliance with the changing laws and applicable regulations in Banking and Financial Services, including (but not limited to) the Gramm-Leach-Bliley Act Cybersecurity requirements
• Oversee periodic Federal examination, security audits, internal threat hunting, internal & third-party penetration tests, simulations, control testing, and other assurance activities to validate controls.
• Collaborate with adjacent colleagues in Business Continuity Planning, Enterprise Risk Management, Audit, and Physical Security.
• Oversee incident response planning, as well as the investigation of security incidents, including impact analysis, root cause analysis, and recommendations for remediation and control enrichment
• Present regular executive-level reporting on the status and progress of the Information Security Management Program. Create awareness of new & emerging risks and the company’s preparedness
• Hire, manage, and train security team, employees, contractors, and third parties
• Create or curate information security awareness training and communicate best practices and risks to all parts of the business
• Perform other duties as assigned

• Bachelor’s Degree in Information Security, Cybersecurity, Computer Science, Computer Engineering, or MIS. Master’s Degree preferred
• 10+ years of experience leading teams in information security in a…