First Entertainment Credit Union is looking for a
Sr. Manager,
Information Security who is responsible for leading the organization's information security program to protect information assets, technology infrastructure, and customer data. This role develops security strategy, oversees cybersecurity operations, governance, risk, and compliance (GRC), ensures regulatory compliance, manages security risks, and partners across the organization to strengthen the overall security posture.
The Sr. Manager will serve as a trusted advisor on cybersecurity strategy, emerging threats, risk exposure, and security investments. They will provide advice on security architecture, technology implementations, cloud adoption, and security requirements for new systems and initiatives. The role maintains and enhances cyber resilience through business continuity planning, disaster recovery management, cyber incident response planning, ransomware preparedness exercises, tabletop testing, and recovery readiness.
This is a full-time hybrid in Hollywood, CA and reports to the VP, Enterprise Risk Management. For candidates in California, the targeted pay range is between $130,000 to $170,000.
Responsibilities - Develop, execute, and continuously mature the enterprise Information Security Program, including security strategy, governance frameworks, policies, standards, procedures, roadmaps, and annual planning initiatives.
- Establish and maintain security governance practices aligned with organizational objectives and provide cybersecurity reporting, metrics, risk insights, and strategic recommendations to executive leadership and the Board.
- Lead enterprise cyber risk management activities, including risk assessments, cyber risk register ownership, emerging threat analysis, risk treatment planning, and integration with the enterprise risk management framework.
- Oversee security operations, including security monitoring, incident detection, SOC relationships, incident response coordination, forensic investigations, vulnerability remediation, and post-incident corrective actions.
- Direct identity and access management (IAM) programs, including least-privilege access controls, privileged access management, user access certifications, and segregation of duties compliance.
- Lead vulnerability and threat management programs, including vulnerability scanning, pen test, threat intelligence review, risk-based remediation prioritization, and patch management oversight.
- Oversee third-party cybersecurity risk management, including vendor assessments, SOC report reviews, cloud security evaluations, ongoing risk monitoring, and remediation of control gaps.
- Ensure compliance with applicable cybersecurity laws, regulations, frameworks, and industry standards, including but not limited to NCUA, FFIEC, GLBA, PCI DSS, NIST, CIS Controls.
- Lead cybersecurity audits, exams, and regulatory readiness efforts, including regulatory requests, corrective action tracking, policy exception management, risk acceptance processes, and control assessments.
- Maintain and enhance cyber resilience through business continuity planning, disaster recovery coordination, cyber incident response planning, ransomware preparedness exercises, tabletop testing, and recovery readiness.
- Develop and promote enterprise security awareness and education programs, including phishing simulations, executive cybersecurity education, and initiatives that foster a security-first culture.
- Develop and maintain cybersecurity KRIs, KPIs, dashboards, and reporting processes while administering and optimizing Governance, Risk, and Compliance (GRC) platforms and tools.
Requirements- Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, or a related field. A Master's degree preferred but not required.
- 8+ years of progressive information security, cybersecurity, risk management, or IT governance experience, including 5+ years in a leadership or people management role.
- Strong knowledge of cybersecurity frameworks, standards, and regulations, including NIST Cybersecurity Framework, NIST 800-53, FFIEC guidance, GLBA, CIS Controls, ISO 27001, and applicable financial services regulatory requirements.
- Professional certifications such as CISSP, CISM, CRISC, CISA, CGEIT, CCSP, or equivalent preferred but not required.
- Prior experience within the banking, credit union, financial services, fintech, or other highly regulated industries preferred but not required.
- Experience conducting enterprise cyber risk assessments, maintaining risk registers, developing risk treatment plans, and integrating cyber risk into enterprise risk management programs.
- Proficiency in security operations, vulnerability management, threat intelligence, penetration testing, and third-party cybersecurity risk management programs.
- Strong understanding of identity and access management, privileged access controls, segregation of duties, and security governance best practices.
- Experience reviewing technology implementations, cloud environments, network architectures, and system designs to identify and mitigate security risks.
- Experience supporting business continuity, disaster recovery, cyber resilience planning, tabletop exercises, and ransomware preparedness activities.
- Exceptional written, verbal, and presentation skills, with the ability to effectively communicate across all audience levels.
