Information Security Officer

Description

The Information Security Officer (ISO) shall be responsible for developing, implementing, and managing the Bank's Information Security Program and policies to ensure the confidentiality, integrity, and availability of bank information assets. ISO serves as the primary leader for cybersecurity governance, risk management, regulatory compliance, incident response, and security awareness initiatives. This position ensures compliance with applicable banking regulations, including FFIEC guidance, GLBA, Pennsylvania Department of Banking, Interagency Guidelines Establishing Information Security Standards, state regulations, and cybersecurity best practices.

As a key member of the Bank's risk management framework, the ISO provides independent oversight and possesses independent authority for information security risk reporting to executive management and the Board of Directors.

• Develop and maintain the bank's information security strategy, risk tolerance, policies and information security exception management for alignment with business objectives.
• Conduct risk assessments and report findings to senior management and the board.
• Ensure alignment of security controls with business objectives and regulatory requirements.
• Monitor third-party vendor security practices.
• Provide employee and board training and awareness programs.
• Establish and maintain the Bank's cybersecurity strategic roadmap.
• Provide cyber risk appetite and operational resilience reporting
• Ensure the Bank's Information Security Program aligns with Information security frameworks (NIST Cybersecurity Framework (CSF 2.0), CIS Critical Security Controls (CIS Controls), and ISO/IEC 27001)

• Present cybersecurity risk assessments, program updates, significant cybersecurity incident reporting, third party cyber risks, emerging threats, remediation efforts and strategic information security initiatives to executive management and the Board.
• Maintain Information Security compliance standards (GLBA Safeguards Rule compliance, customer information protection, security awareness program effectiveness, policy exception management, annual Information Security Program review.
• Develop mitigation plans for identified vulnerabilities and threats.
• Develop and oversee security control testing and validation efforts, for existing Information Security Technology, upgrades and enhancements.
• Responsible for leading the bank's information security risk assessments (ISRA, GLBA, Privacy)
• Lead the Bank's Incident Response Program. Coordinate response activities during security incidents. Ensure proper breach notification and regulatory reporting procedures are followed.
• Conduct post-incident reviews and lessons-learned sessions. Maintain cyber resilience and recovery procedures.
• Participate in vendor due diligence reviews. Assess SOC reports, penetration test results, and security questionnaires. Monitor vendor cybersecurity performance and remediation efforts. Support contract language related to cybersecurity requirements.
• Working with the Information Technology Management Team, oversee security monitoring and threat detection activities.
• Review and manage cybersecurity alerts and incident investigations.
• Responsible for reviewing key performance indicators for the information security program. These include but are not limited to the following:
• Completion of annual risk assessments
• Reduction of critical vulnerabilities
• Regulatory examination results
• Audit finding remediation timelines
• Employee phishing test performance
• Third-party risk assessment completion rates
• Incident detection and response metrics
• Security awareness training completion rates
• Compliance with Board-approved security objectives
• Develop and maintain cybersecurity…