Director OF Information Security

The AVP, Information Security Governance, leads the Bank's security governance team in identifying security requirements to mitigate internal and external risk. This role oversees the creation of policies, standards, and governance in support of the Information Security Program. Additionally, the role manages the enterprise security risk intake, security risk assessments, security-based compliance, third-party security review, and security awareness across the enterprise.
The AVP of Information Security Governance partners with Cyber Security and IT to ensure technology aligns with security standards and risk is managed appropriately, providing independent oversight. This position will chair and/or represent ISG in multiple governance committees, contributes to setting security standards across technology and business processes and advises on activities necessary to assess and protect the confidentiality, integrity, and availability of Bank information and systems.


Education and Experience Requirements:
* Bachelor's degree in any field combined with 2 or more years of on-the-job experience with information technology or security.
* A minimum of 5 years of experience in any one of the following roles: IT Audit, Information Technology or Security Risk, Cyber Security, or Information Security.
* A minimum of 2 years of leading in IT or Security risk, audit, compliance, or governance.
* Leadership experience

Certificate, Licenses and Registration Requirements:
* Preferred but not required certifications include but are not limited to:
o Certified in Risk and Information Systems Control (CRISC)
o Certified Information Systems Auditor (CISA)
o Certified Information Security Manager (CISM)
o Certified Information Systems Security Professional (CISSP)

Knowledge, Skill, and Ability Requirements:
* Strong knowledge of privacy, information security standards and best practices.
* Experience implementing and providing oversight for information security standards in a complex business environment.
* Experience with risk assessment processes and practices.
* Able to build and maintain strong relationships across the organization, including multiple business units and senior leadership.
* Proven project management skills.
* Proven ability to think strategically about business, risk, and technical challenges impacting IT security.
* Excellent communication skills with all levels of management and outside vendors, technical and non-technical users.
* Must have excellent research, analytical, and documentation skills.
* Ability to work independently and within a team.

Essential Functions:
* Perform duties in three lines of defense model.
* Advise on security architecture in line with FFIEC guidance, framework alignment (NIST, CIS), and security best practices.
* Oversee security specific tooling configurations.
* Participate in determining security requirements for new products and services.
* Lead a team of information security professionals.
* Help ensure IT compliance with technical portions of applicable regulations and guidelines.
* Perform risk assessments and attestations of controls to author executive level reports and memorandums of the outcomes.
* Perform due diligence security reviews on the Bank's existing and proposed new third-party vendors.
* Maintain, track, and report to senior leadership a register of information security related identified control gaps and their associated risks through remediation.
* Participate in and assist with facilitating tabletop exercises.
* Document Information Security Standards.
* Contract reviews for new or modified external vendor services.
* Monitoring of cyber health of third parties who house Bank information.
* Oversee the Bank's Security Awareness program.
* Advise on security architecture for networking, infrastructure, applications and cloud environments.
* Assist with governance for vulnerability assessments, penetration testing, and risk assessments.
* Provide collaboration throughout the Bank in data security matters to ensure compliance with all established data security policies and procedures.
* Assist with the evaluation and recommendation of new Information Security systems.
* Review current processes and procedures for technical portions of IT compliance, recommend improvements for higher maturity.
* Research and evaluate proposed security capability solutions for adherence to documented Bank standards, policies, guidelines, and technical portions of regulatory requirements.
* Perform gap analyses.
* Participate in various projects to advise on Information Security requirements and governance.
* Make security decisions in a crisis on behalf of the CISO if the CISO is not available.

All employees have the responsibility and the accountability to serve as risk managers for their businesses by understanding, reporting, responding to, managing and monitoring the risk they encounter daily as required by Dollar Bank's risk management program. Compliance with regulatory laws and company procedures is a required component of all position descriptions.

Supervisory Responsibilities:
* Achieves results by motivating and stimulating team members; promotes commitment to common goals by communicating team vision and mission.
* Works with employees to identify development opportunities and create career development plans.
* Coaches and mentors employees on their strengths and areas for improvement, providing constructive feedback.
* When needed, selects talented individuals from inside and outside of the Bank, hiring individuals whose capabilities match the needs of the organization in a timely and prudent manner.