Overview

Director, Information SecurityUS-CA-San DiegoJob ID: Type: Regular Full-Time# of Openings: 1Category: Information TechnologyCorporate OfficeOverview The Director, Information Security is BluPeak's leader in enterprise information security, maintaining, enhancing and administering the Information Security Policy and Program. This role champions the protection of member data and sensitive business information while ensuring the integrity and confidentiality of all BluPeak technology systems, encompassing computers, cloud-hosted services, databases, storage systems, websites, custom software development, and secure data transfers. This role ensures BluPeak can successfully adapt and respond to sophisticated, emerging threats. A critical position within our Risk Management team, the Director, Information Security will serve as the Information Security Officer and is responsible for second-line risk oversight responsibilities requiring an understanding of a variety of technologies in place at BluPeak, as well as regulations, standards, and guidelines that influence the security program. The Director maintains a comprehensive understanding of the technologies, systems, information assets, and third-party services that support the credit union's operations and evaluates the associated risks, control effectiveness, and alignment with applicable regulatory requirements and industry standards. The role provides independent risk assessment, monitoring, challenge, and reporting to management and appropriate governance committees, while partnering with first-line technology and business teams to strengthen security practices and ensure risks are identified, appropriately managed, and escalated when necessary. This role collaborates with senior leadership to align security initiatives with organizational goals, partners with the third party risk management team to safely onboard and monitor vendors, manages security training programs, supports a culture of security, and drives the cybersecurity program to ensure a robust, forward-looking security posture. Responsibilities Cybersecurity Strategy, Governance, and Leadership • Serve as BluPeak's cybersecurity advisor, engaging with committees, working groups, senior leadership, and key stakeholders to develop, govern, and continuously mature a cybersecurity program that is fully integrated with business goals, compliance mandates, risk management frameworks, and the credit union's overarching strategic vision. • Maintain a robust and resilient security posture in response to emerging and sophisticated threats appropriate to the changing business environment. • Manage the development and continuous improvement of the Information Security Policy and Program, ensuring alignment with industry standards, regulatory requirements and guidelines such as the Gramm Leach Bliley Act (GLBA), FDIC, NCUA, CIS, NIST, and PCI. • Prepare and present the annual Information Security Program report to the Board of Directors, detailing program status, risk assessments, and forward-looking initiatives. • Manage and develop information security program-related policies and procedures for presentation to the Information Technology Steering Committee. • Administer the security risk assessment, identifying vulnerabilities and prioritizing remediation efforts in partnership with relevant stakeholders. • Act as a subject matter expert in AI and emerging-technology risk governance and provide input on the security budget. • Establish and monitor security metrics/KRIs and provide input on the security budget. Information Security Program and Risk Management • Manage the development and continuous improvement of the Information Security Policy and Program, ensuring alignment with industry standards, regulatory requirements, and guidelines such as GLBA, FDIC, NCUA, CIS, NIST, and PCI. • Administer the security risk assessment process, identifying vulnerabilities and prioritizing remediation efforts in par