SVP/Chief Information Security Officer

It Starts With Our Employees FourLeaf's ultimate goal is to provide the best-in-class member and employee experience, and it all begins with two things: hiring incredible people and giving them a great place to work. What You’ll Do The Senior Vice President (SVP)/Chief Information Security Officer (CISO) is responsible for establishing, executing, and continuously enhancing the Credit Union’s enterprise-wide information security and cybersecurity program.

The SVP/CISO provides strategic leadership and governance over information security, cyber risk management, threat intelligence, incident response, vulnerability management, third-party technology risk, and regulatory compliance. Working in close partnership with Second Line of Defense (2LOD) Risk Management and Compliance functions, the CISO ensures the Credit Union maintains a strong security posture that protects member information, critical business operations, and technology assets while enabling business growth and innovation.

Core Contributions Information Security Strategy & Governance Develop, implement, and maintain the Credit Union’s enterprise information security strategy, framework, policies, and standards. Implement and enforce enterprise security policies, procedures, and standards jointly developed with Second Line of Defense (2LOD) Risk Management and Compliance teams. Ensure alignment of security practices with applicable regulatory requirements, industry standards, and Credit Union business objectives.

Provide regular reporting to executive management, Board committees, and regulators regarding cybersecurity risk, security posture, emerging threats, and remediation activities. Establish and maintain information security governance processes, metrics, and key risk indicators. Cybersecurity Operations Lead the Credit Union’s cybersecurity operations program, ensuring effective protection of information assets and infrastructure.

Oversee enterprise threat detection, threat intelligence, security monitoring, incident response, and vulnerability management activities. Ensure timely response to security events and coordinate communication, recovery, and post-incident reviews. Oversee penetration testing, vulnerability assessments, security monitoring tools, and remediation programs. Third-Party & Vendor Cyber Risk Management Own and manage the cybersecurity vendor risk assessment process for third-party service providers, fintech partners, and technology vendors.

Evaluate and monitor the security posture of third-party technology relationships throughout the vendor lifecycle. Collaborate with Procurement, Legal, Information Technology, and Risk Management to ensure appropriate cybersecurity due diligence and contractual protections. Review vendor security controls, independent audit reports, penetration test results, and other security attestations. Ensure ongoing monitoring and remediation of identified vendor security risks.

Risk Management & Compliance Partner with 2LOD teams to identify, assess, monitor, and mitigate information security and cyber risks. Support enterprise risk management initiatives by providing subject matter expertise on cyber and technology risks. Ensure compliance with NCUA guidance, FFIEC cybersecurity expectations, GLBA, state privacy requirements, and other applicable regulatory standards.

Track and report remediation of audit findings and risk issues. Leadership & Collaboration Provide leadership and direction to information security personnel and external security partners. Foster a culture of cybersecurity awareness and accountability across the organization. Collaborate with Information Technology, Operations, Digital Banking, Enterprise Risk, Compliance, Internal Audit, and business line leaders to integrate security into business processes and technology initiatives.

Advise senior management on security implications of strategic initiatives, digital transformation efforts, and emerging t