Chief Information Security Officer

Responsibilities

• Develop and implement a comprehensive information security program, including policies, procedures, and controls.
• Monitor and urgently address current and emerging cybersecurity risks that pertain to the Bank and its customers.
• Advise the Bank's Chief Risk Officer, IT Committee, and Senior Management in developing and implementing information technology safeguard strategies and controls to mitigate risks.
• Conduct ongoing information security compliance monitoring and perform IT and customer information risk assessments for all areas of the Bank.
• Monitor and continuously upgrade information security and business resiliency capabilities across the enterprise.
• Manage enterprise‑wide Business Continuity Planning (BCP), including establishing and validating policies and procedures to restore business‑critical services of the Bank in the event of a disaster or event.
• Work closely with and challenge the Director of Information Technology and the Chief Risk Officer to develop strategic plans and make recommendations for significant information technology projects involving functional changes within the Bank.
• Provide the Board with an annual assessment of the Bank's Information Security program in accordance with the Gramm–Leach–Bliley Act.
• Assure audit compliance and procedure quality control through internal and external reviews, recommend and initiate corrective actions, and ensure system resources are in compliance with established Bank policies, procedures, and state and federal laws, rules and regulations.
• Manage physical security policies, protocols, procedures, and systems.
• Ensure policies and procedures are consistently applied across the Bank and ensure adherence to regulatory requirements.
• Continuously monitor and assess the information security team and resources to ensure the organization employs and develops top talent.
• Perform personnel actions, including performance appraisals, disciplinary actions, and interviewing candidates for employment, and supervise the daily activities of the department, including, but not limited to, effective delegation of assignments, developing work schedules, and providing necessary training.
• Foster a culture of security awareness and accountability throughout the organization.
• Work with the Training Officer to develop and deliver security awareness and training programs to educate employees on security best practices.
• Support Community Reinvestment Act (CRA) through business development efforts. Actively participate in community organizations.
• Maintain current knowledge of bank regulations and ensure compliance with all Federal, State, and Bank policies, procedures, and regulations.
• Perform other duties as assigned.

• Bachelor's degree in Computer Science, Information Technology, or a related field.
• Extensive experience in information security management, including experience in a leadership or executive role.
• Professional certifications such as ISACA‑CISM and/or ISC2‑CISSP are required.
• In‑depth knowledge of information security frameworks, standards, and best practices.
• Strong understanding and experience in implementing the guidelines of FFIEC IT Booklets.
• Strong understanding of risk management principles and experience conducting risk assessments.
• Demonstrated ability to develop and execute strategic plans and initiatives.
• Strong leadership and people management skills, with the ability to build and develop a high‑performing security team.
• Up‑to‑date knowledge of emerging threats, vulnerabilities, and security technologies.
• Ability to deal with complex problems involving multiple facets and variables in non‑standardized situations.

Demonstrates expertise in developing and implementing comprehensive information security programs, including risk management, compliance monitoring, and business continuity planning. Possesses strong leadership skills to build and manage high‑performing security teams while ensuring adherence to regulatory requirements.