Cybersecurity Governance, Risk and Compliance Manager

SF Fire Credit Union is seeking a full-time Cybersecurity Governance, Risk and Compliance Manager to provide independent oversight of the Credit Union's cybersecurity risk. Operating independently of the CIO and IT management reporting lines, this role reviews IT cybersecurity practices and control effectiveness, challenges decisions to defer remediation or accept risk, and ensures material cybersecurity issues reach the appropriate decision makers. Success in this position requires deep cybersecurity expertise, sound judgment, and the ability to communicate clearly and challenge constructively across IT, Information Security, Compliance, Legal, and business leadership.
What You Get To Do
Independent Risk Assessment and Challenge

• Independently review IT cybersecurity practices, policies, configurations, procedures, and control effectiveness
• Assess whether IT's response to emerging vulnerabilities, security advisories, and threat intelligence is timely and proportionate to the institutions risk exposure
• Recommend improvements to IT controls, processes, resource allocation, and remediation plans
• Challenge decisions to defer remediation or accept cybersecurity risks and require documented justification and appropriate risk acceptance

Cross-functional Coordination and Communication

• Establish expectations for sharing material cybersecurity information among IT, Information Security, Marketing, Compliance, Legal, Business Leadership, and affected functions
• Verify that relevant stakeholders are notified when a threat may affect the organization, its website, customer-facing systems, confidential information, or business operations
• Ensure that threat assessments and recommended actions are communicated to the appropriate decision makers, with clear ownership and deadlines

Oversight, Validation, and Escalation

• Independently monitor remediation of identified cybersecurity weaknesses and verify copletion of material corrective actions
• Maintain a risk-based register of significant cybersecurity issues, remediation commitments, overdue actions, and accepted risks
• Escalate material or overdue issues to the CRO and, when appropriate, the CEO or the appropriate board committee provide periodic reporting on cybersecurity risk exposure, control effectiveness, incident response, phishing trends, and outstanding remediation

Authority and Organizational Positioning
The role should operate independently of the CIO and IT management reporting lines. It should have sufficient access to relevant systems documentation, policies, incident records, assessment results, and personnel to perform its oversight responsibilities.
The role should have the authority to request corrective action plans, challenge proposed remediation timelines, recommend additional safeguards, and escalate unresolved concerns without IT management approval.
Where a material risk requires immediate protective action, the role should be empowered to recommend urgent containment measures and invoke a defined escalation process. Any authority to direct or suspend technology operations should be explicitly established in the organization's governance framework, including clear decision rights, emergency procedures, and coordination requirements with the CIO and CRO.
The role should be appropriately resourced for the institution's size and risk profile. The initial structure may be a dedicated Cybersecurity Governance, Risk and Compliance Manager or an appropriately qualified individual with a clearly defined mandate, provided the necessary independence, expertise, and authority are maintained.
What We Look For In You
Desired Qualifications:

• Bachelor's degree in Information Security, Computer Science or related field, Advanced degree preferred
• Required 7+ years of progressive cybersecurity experience or related experience in IT, Compliance, or Audit
• CISSP, CCSP, CISM, GIAC, CISA, CRISC, or PCI-related certifications, including PCIP, ISA, or QSA

This job description describes the general nature and level of work expected of the position. Responsibilities may evolve as organizational needs and strategic priorities change.
Salary
This compensation range takes into account the wide range of factors considered in making compensation decisions, including but not limited to skill sets, experience and training, licensure and certifications, and other business and organizational needs. At SFFCU, it is not typical for an individual to be hired at or near the top of the range for their role, and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range for the San Francisco market is an annual base salary of $144,800 to $217,000.
OUR BENEFITS
We have a competitive compensation and benefits package, but the true reward of working for SF Fire Credit Union goes beyond what you'll see on a pay-stub. We genuinely care our employees and we strive to invest in their professional and personal growth. We're a relatively small organization at about 200 employees, so you can see the impact of your efforts and the value your contributions bring to our members and fellow employees.

• 401(k) and Employer Match
• Health, Vision, Dental and Life Insurance
• Annual Incentive/Bonus Program
• Tuition Reimbursement Program
• 11 Paid Holidays + Competitive PTO package
• Home & Consumer Loan Program (Discounted Rates)
• Professional development and training programs
• On-demand personal coaching resource
• Wellness Program (Discounted Gym Membership)