The posting
Job Description Summary
Under the direction of the Sr. AVP, Information Security, plans, organizes, integrates, manages, and evaluates the day-to-day activities of the Credit Union’s Information Security Department; while maintaining the advanced technical knowledge and hands-on capabilities necessary to support security operations; administers, plans and manages the acquisition, installation and maintenance of the Credit Union’s information security infrastructure; including security information and event management (SIEM), and threat intelligence systems to detect and monitor intrusions; secures data, monitors system usage and manages rules and permissions for access. Maintains the technical capability to directly support complex security investigations, incidents, and operational activities when needed. Oversees planning and implementation of strategic plans; ensures projects are designed and implemented efficiently and effectively; directs departmental business continuity planning to minimize risk. Possesses a strong technical background and understands risk, mitigation, and technical controls. Manages security controls to maintain an organization-wide information security program to preserve the availability, integrity, and confidentiality of the Credit Union's information assets. Participates as a member of the Cybersecurity Incident Response team during security events and serves as a backup on the change management team.
Job Description
Essential Duties and Responsibilities
- Provides leadership and works with staff to develop and retain highly competent, member service-oriented staff through training and day-to-day management practices that support the Credit Union’s mission and strategic goals. Mentors’ security team and places a heavy emphasis on employee retention.
- Establishes performance requirements and objectives for staff; monitors and evaluates their performance; provides coaching and development opportunities; finds ways to recognize performance; addresses performance deficiencies and takes disciplinary action, if warranted, in accordance with Credit Union’s policies and procedures.
- Plans, organizes, evaluates, and manages the work of staff within the department; utilizes resources effectively; implements plans, programs and work processes and procedures necessary to achieve designated results; coordinates and integrates functions within the department and across the Credit Union.
- Leads the team to implement secure enterprise systems and identifies issues that could compromise data confidentiality, integrity, and availability.
- Develops and recommends a variety of security management policies, protocols, systems, and tools, including but not limited to, endpoint security, next gen AV software, EDR solution, cloud security tools, web content filters; network security policies, vulnerability and patch management program and remote access standards guidelines; ensuring compliance with NCUA regulations.
- Manages the technical performance of security monitoring and logging systems, ensuring, reliability of information security alerts; manages adherence with log retention standards; reviewing and reporting incidents requirements; evaluates the vendor-provided patches and upgrades; coordinates the remediation of vulnerability problems with the Technology Division staff, and vendors.
- Oversees security monitoring and detection activities across SIEM, firewall, endpoint, cloud, and other security technologies, ensures significant security events and suspicious activity are appropriately investigated, escalated, documented and remediated; establishes operational priorities and provides management oversight of security investigations.
- Serves as an internal information security consultant by reviewing all system related security controls for current and future systems and products and identifies issues that could compromise data integrity or security.
- Responds, in a timely manner, to information security incidents to minimize potential losses of information assets.
- Collaborate with FS-ISAC and other intelligence sharing agencies ensuring threat intelligence capabilities and information sharing are effectively implemented and delivering value to the business.
- Ensures audit trails, system logs, and other monitoring data sources are reviewed periodically and comply with policies and procedures and audit requirements.
- Oversees, directs, and enhances the security operational functions to detect, analyze, respond to and track information security threats and vulnerabilities.
- Identifies, prioritizes, and sponsors opportunities for security automation, orchestration, and process improvement to improve operational efficiency, strengthen controls and allow staff to focus on higher-risk and higher-value activities
- Recommends necessary changes to the Information Security Program to ensure the confidentiality, integrity and availability of information assets; ensures proper data classification and compliance; maintains an ongoing security awareness program and ensure full compliance with regulatory requirements and privacy laws.
- Serves as a member of the Cybersecurity Incident Response Team during security events and provides management coordination and operational leadership during security events; serve as a backup to the Sr. AVP of Information Security on the change management team.
- Acts as a change agent and drives the department and business forward using effective management, analysis, and strategic skills.
- Evaluates and provides management direction for significant security technology upgrades, enhancements, architectural changes, and control improvements..
- Oversees implementation and effectiveness for cloud-based environments, including but not limited to AWS, Azure, and other cloud platforms used by RFCU and vendors.
- Analyzes technologies and establishes highly effective processes and protocols to ensure comprehensive protection exists to prevent unauthorized entry into the company networks and systems.
- Actively recruits and leads by example to create a culture where employees want to work and places a heavy emphasis on employee retention.
Company Wide Expectations
· Maintains a professional image and demeanor at all times, consistently demonstrating Credit Union RISE Values and adhering to the Code of Ethics.
· Delivers friendly, caring service to internal and external members.
· Complies with all applicable State, Federal and NCUA rules and regulations and all Credit Union policies and procedures.
· Follow all physical and online security procedures and maintain strict confidentiality of all member information.
· Completes all required regulatory and compliance training and maintains required knowledge of Credit Union products and services.
· Works scheduled hours and maintains punctuality.
· Performs other related duties as assigned or requested.
EDUCATION/EXPERIENCE
Minimum Qualifications
To perform this job satisfactorily, an employee must be able to carry out each essential duty competently. The requirements listed below are representative of the education, experience, skills and abilities required.
An equivalent combination of education and experience may be considered.
Education Requirements
- 4 Year / Bachelors Degree in Information Security, Information Technology, Information Systems, Computer Science, or a closely related field. - Required
- Knowledge of PCI DSS (Payment Card Industry Data Security Standards) a plus - Preferred
- At least one of the Information Security Certifications is strongly preferred – e.g., Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Ethical Hacker (CEH), GIAC Certified Incident Handler (GCIH) or related security certification.
Experience Requirement
- 5 Years - Progressively responsible experience in information security, cybersecurity, information technology, security operations or related discipline, including experience with enterprise security technologies, controls, risk management, incident response and regulatory or compliance requirements. - Required
- 2 Years - Management or Supervisory experience, including employee development, performance management, work prioritization and operational oversight. - Required
Skills/Abilities
- Effectively apply internal and external customer service practices and processes to meet quality service standards and achieve member satisfaction.
- Demonstrate an ability to effectively engage, lead, educate, influence, and collaborate across the enterprise.
- Standard methodology for troubleshooting to determine causes of computer hardware, software and processing problems, errors, security events and failures.
- Read, interpret and apply technical information on business processes, and vulnerability information, to technical and non-technical users.
- Demonstrate understanding of information security principles and practices, analysis, development, testing and implementation.
- Ability to understand business asset protection requirements and deliver cost-effective technical solutions.
- Learn and apply information, on a wide range of Credit Union products, services and regulatory compliance requirements, in order to assess member situations and develop solutions.
- Resolve problems utilizing advanced knowledge and experience.
- Communicate in a professional manner and deliver information clearly and effectively. Actively listen to questions, opinions and ideas of others. Use tact and diplomacy in sensitive and confidential situations.
- Use correct English including spelling, grammar and punctuation.
- Operate computers and use business software and other standard office equipment.
- Understand and follow written and oral instructions.
- Set priorities and manage one’s own time effectively.
PHYSICAL DEMANDS
Physical Demands Disclaimer
The physical demands described here are representative of those that must be met by employees to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
Physical Requirements
- Intermittent standing, sitting, walking, bending and climbing.
- Using hands repetitively to handle, feel or operate computers and other standard office equipment.
- Reaching with hands and arms.
- Lifting and carrying up to 25 pounds.
WORK ENVIRONMENT
Work Environment Disclaimer
An employee in this job will experience the following main work environments, others not listed may also be encountered on occasion;
Work Environment
- Works in a general office environment.
Redstone Federal Credit Union is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veteran status or status as an individual with disability. All qualified applicants will not be discriminated against on the basis of disability.
We are proud to be a Drug-Free and Tobacco Free Workplace.
