Director, Information Security who is responsible for leading the organization's information security program to protect information assets, technology infrastructure, and customer data. This role develops security strategy, oversees cybersecurity operations, governance, risk, and compliance (GRC), ensures regulatory compliance, manages security risks, and partners across the organization to strengthen the overall security posture.
The Director will serve as a trusted advisor on cybersecurity strategy, emerging threats, risk exposure, and security investments. They will provide advice on security architecture, technology implementations, cloud adoption, and security requirements for new systems and initiatives. The role maintains and enhances cyber resilience through partnership with the enterprise business, oversight of cyber recovery security requirements, coordination with IT on disaster recovery, cyber incident response planning, ransomware preparedness exercises, tabletop testing, and recovery readiness; IT retains ownership of technical disaster recovery execution.
This is a full-time hybrid in Hollywood, CA and reports to the VP, Enterprise Risk Management. For candidates in California, the targeted pay range is between $150,000 to $190,000.
Responsibilities - Develop, execute, and continuously mature the enterprise Information Security Program, including security strategy, governance frameworks, policies, standards, procedures, roadmaps, and annual planning initiatives.
- Establish and maintain security governance practices aligned with organizational objectives and provide risk insights and strategic recommendations to executive leadership and the Board.
- Provide GRC oversight and challenge of IT and the Information Security Program, including security requirements, control assessments, risk and remediation reviews, policy exceptions, and escalation of material security risks, while maintaining appropriate separation from Internal Audit assurance.
- Oversee security operations, including security monitoring, incident detection and response, SOC coordination, forensic investigations, remediation, and escalation of unresolved security risks.
- Oversee identity and access management (IAM) security requirements, including least-privilege access, privileged access management, user access certifications, and segregation of duties compliance.
- Manage vulnerability and threat management programs, including vulnerability assessments, penetration testing, threat intelligence, remediation prioritization, patch management oversight, and ongoing risk monitoring.
- Oversee information security risk throughout the third-party vendor lifecycle, including security due diligence, risk assessments, control reviews, ongoing monitoring, remediation, and escalation of material security risks in partnership with Enterprise Risk Management, IT, vendor management, and business owners.
- Ensure compliance with applicable cybersecurity laws, regulations, frameworks, and industry standards, including but not limited to NCUA, FFIEC, GLBA, PCI DSS, NIST, CIS Controls.
- Manage cybersecurity audit and examination readiness, including regulatory requests, evidence collection, control assessments, corrective actions, policy exceptions, risk acceptance, and remediation tracking.
- Manage cyber resilience and recovery readiness, including cyber incident response planning, ransomware preparedness, tabletop exercises, recovery assessments, and coordination with business continuity and IT.
- Develop and promote enterprise security awareness and education programs, including phishing simulations, executive cybersecurity education, and initiatives that foster a security-first culture.
- Develop and maintain cybersecurity KRIs, KPIs, dashboards, and reporting processes, and administer and optimize GRC platforms and tools.
Requirements- Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, or a related field. A Master's degree preferred but not required.
- 10+ years of progressive information security, cybersecurity, risk management, or IT governance experience, including 5+ years in a leadership or people management role.
- Strong knowledge of cybersecurity frameworks, standards, and regulations, including NIST Cybersecurity Framework, NIST 800-53, FFIEC guidance, GLBA, CIS Controls, ISO 27001, and applicable financial services regulatory requirements.
- Professional certifications such as CISSP, CISM, CRISC, CISA, CGEIT, CCSP, or equivalent preferred but not required.
- Prior experience within the banking, credit union, financial services, fintech, or other highly regulated industries preferred but not required.
- Experience conducting enterprise cyber risk assessments, maintaining risk registers, developing risk treatment plans, and integrating cyber risk into enterprise risk management programs.
- Demonstrated experience applying GRC oversight and effective challenge to IT risk assessments, control design and effectiveness, and remediation plans, while maintaining clear boundaries between operational ownership, risk oversight, and independent assurance.
- Proficiency in security operations, vulnerability management, threat intelligence, penetration testing, and third-party cybersecurity risk management programs.
- Experience overseeing third- and fourth-party security risk throughout the vendor lifecycle, including evaluation of vendor assurance reports, material subcontractor dependencies, contractual security provisions, remediation, and residual risk.
- Strong understanding of identity and access management, privileged access controls, segregation of duties, and security governance best practices.
- Experience reviewing technology implementations, cloud environments, network architectures, and system designs to identify and mitigate security risks.
- Knowledge of data protection and security-by-design practices, including data classification, encryption, data loss prevention, secure development, and security reviews for new technology and material changes.
- Experience supporting business continuity, disaster recovery, cyber resilience planning, tabletop exercises, and ransomware preparedness activities.
- Experience in incident governance and escalation, including coordination of material cyber incidents with IT, Legal, Compliance, ERM, and business leadership, notification assessments, and post-incident lessons learned.
- Exceptional written, verbal, and presentation skills, with the ability to effectively communicate across all audience levels and translate technical exposures into business impacts, risk treatment options, investment priorities, and decisions requiring escalation to executive leadership and the Board.
- Experience developing security roadmaps, managing program budgets and service providers, and prioritizing security investments and resources based on risk.
