Information Security Risk Officer

Hudson Valley Credit Union is currently recruiting for the position of Information Security Risk Officer. Primary Function: provides leadership, direction, and coordinated oversight as the TPRM Liaison, HIPAA & Privacy function, Artificial Intelligence Subject Matter Expert, and Threat Analysis function. The ISRO establishes clear accountability, integrates risk information across these disciplines, provides independent challenges, escalates material concerns, and delivers decision-ready reporting to management and appropriate governance committees.

The role partners with other second line risk functions including Cybersecurity Governance and Risk, Enterprise Risk Management, Legal & Compliance, Data Governance and AI Governance while coordinating with First Line risk functions of, Information Assurance, business lines, Technology, Procurement, and Third Line of Defense Internal Audit to protect member and organizational information, strengthen operational resilience, and support regulatory and examination readiness.

• Lead and coordinate the Cybersecurity Governance & Risk responsibilities assigned to the ISRO function, including TPRM liaison, HIPAA and privacy, artificial intelligence risk, and threat analysis.
• Establish role expectations, work priorities, decision rights, escalation paths, service levels, and performance measures for aligned functions; provide independent, risk-based oversight and effective challenge of cybersecurity and technology risk decisions.
• Evaluate control design and operating effectiveness across business processes, information systems, cloud services, data environments, third parties, artificial intelligence use cases, and critical technology changes.
• Coordinate cybersecurity policy exceptions and risk acceptances, including business justification, compensating controls, approval, expiration, and periodic reassessment.
• Consolidate risk themes, trends, exceptions, issues, remediation status, audit and examination matters, and emerging concerns into clear management and governance committee reporting.
• Provide cybersecurity risk leadership and functional direction for third-party risk activities, including risk tiering, due diligence, contract security requirements, assurance review, ongoing monitoring, issue management, risk acceptance, renewal, and termination.
• Partner with Enterprise Risk Management, Procurement, Legal, Compliance, Vendor Management, Technology, Privacy, business relationship owners, and other stakeholders to integrate cybersecurity, privacy, resilience, and data protection requirements throughout the third-party lifecycle.
• Monitor third-party and fourth-party findings, control changes, incidents, concentration risk, cloud risk, service resilience, and remediation commitments; elevate risks outside approved tolerance and produce related metrics, portfolio insights, and examination-ready evidence.
• Provide coordinated oversight for HIPAA and privacy-related cybersecurity risks, including risk assessments for systems, business processes, third parties, data sharing, cloud services, and change initiatives involving protected, confidential, or regulated information.
• Partner with Legal, Compliance, Data Governance, Technology, Incident Response, business owners, and third-party stakeholders on privacy-by-design, minimum-necessary access, data lifecycle safeguards, incident and breach assessment support, control requirements, and evidence readiness.
• Provide leadership for AI risk oversight and represent cybersecurity risk in enterprise AI Governance and Data Governance activities, including intake, inventory, tiering, assessment, approval, testing, documentation, monitoring, exception, and escalation expectations for AI use cases…