Information Security Manager

The Information Security Manager is responsible for implementing and overseeing the credit union’s enterprise-wide information security / cyber security program ("Information Security Program") and will act as the designated Information Security Officer of the credit union. The position will serve as a process owner and strategic leader of the Information Security Program, ensuring that the program aligns with the vision, mission and business plans.

This role is accountable to complete all assigned compliance and information security training and comply with the credit union’s policies and procedures related to the Bank Secrecy Act and Office of Foreign Assets Control (OFAC).

Assumes responsibility for the execution of the Information Security Program:

• Create and complete comprehensive risk assessments and cybersecurity assessment tools in line with industry best practices.
• Perform firewall configuration and/or modifications, as needed.
• Monitor network resources, including but not limited to firewall, virus, and spyware protection, analyze and investigate security events and respond to incidents.
• Perform network device hardening in alignment with industry best practices.
• Validate server and endpoint hardening activities and provide direction according to industry best practices.
• Perform network analysis, as needed.
• Work with internal and external auditors and engage productively with regulatory examiners to provide program documentation and resolve and remediate findings.
• Create and maintain policies and procedures in support of the Information Security Program.
• Manage the enterprise system logging program, develop controls for system monitoring and alerting, interpret the log activities, develop plans for remediation efforts and report results to management.
• Lead the credit union’s incident response efforts, including testing, plan creation, communication with management and the Board of Directors (when needed), utilization of external and internal resources, notification of impacted members and regulatory authorities, documentation of all efforts and conducting lessons learned to ensure improvements are made to the program.
• Implementing a comprehensive training and awareness program for all employees and volunteers, tracking compliance and understanding and reporting on key training metrics.
• Prepare and present quarterly and annual information security reports as directed by management and the Board of Directors.
• Actively engage, participate and support the Enterprise Risk Management Program, including ensuring consistency in reporting, risk assessments and communications.
• Prepare a detailed budget for all expenses associated with the Information Security Program.
• Review the information security and business resiliency documentation for vendors that are deemed high risk and those that have access to, store or transmit non-public personal information of members and employees.
• Review contracts with third-party vendors for agreeable terms associated with cyber security and offer input and guidance to key stakeholders during the contract review process.
• Assist with the due diligence reviews of new vendors and the setup and implementation of new and existing systems and software.
• Assist with the development and maintenance of the credit union’s Business Continuity Plan and business impact analysis.
• Develop strong working relationship with management and Team Members to develop and implement controls and configurations aligned with information and cybersecurity policies and legal, regulatory and audit requirements.
• Serve as the Information Security Officer and Privacy Officer of the credit union.
• Ensure audit trails, system logs and other monitoring data sources are reviewed periodically and follow policies and audit requirements.
• Assess current and emerging threats, cyberattacks and vulnerabilities and effectively communicate recommended actions and strategies to management.
• Maintain thorough knowledge of and ensure compliance with applicable federal and state laws, rules, regulations, REV policies and procedures, and service level agreements.
• Manage the credit union’s data classification…