Information Security Officer

Information Security Officer At Richwood Bank, our purpose is to inspire, protect, and celebrate anything that makes communities thrive. Have you ever wanted to work for a company that exceptionally lives its values? One hundred and fifty years ago, we began as a small community bank. Today, we are still a community bank – as well as a payroll processing team, a marketing agency, a coffee shop, and more. We have flipped the switch on traditional banking. Yet, we have always aimed to provide the very best customer experience, contribute to the greater good of our local communities, and make every effort to be the best employer in the area with a company culture that works hard to develop, recognize, and award its team members. Richwood Bank has a comprehensive benefits package for full-time employees including, but not limited to, medical and wellness program, dental, vision, employee assistance plan, life insurance and supplemental short-term disability. Full time and part time employees have access to a 401(k) plan, an enhanced Wellness program, tuition reimbursement, and tons of professional development opportunities!The Information Security Officer (ISO) leads Richwood Bank's information security program to protect customer and employee information, maintain the confidentiality, integrity and availability of bank systems, and support secure banking operations. The ISO combines program leadership with practical oversight of security operations, risk management, policies, architecture and employee awareness.This role directs assigned security personnel and coordinates managed security providers, incident response partners and virtual CISO resources, as applicable. The ISO works closely with systems and network teams, Compliance, Risk Management, Human Resources and business leaders to implement appropriate safeguards and communicate security priorities in business terms. Richwood Bank prides itself on a unique culture and all team members should be active and engaged participants.Essential Functions Strategy and Planning Develop, maintain and measure a risk-based information security program aligned with the bank's business objectives, risk appetite and applicable requirements. Maintain security architecture, standards and control baselines in partnership with systems, network and application owners; incorporate security into technology projects and changes. Create and maintain information security policies, standards, guidelines and procedures; coordinate approval, communication, periodic review and documented exceptions. Lead information security risk assessments, maintain a risk register, and recommend prioritized remediation plans with accountable owners and target dates. Develop and maintain the security awareness program, including onboarding, recurring training, phishing exercises and role-specific education. Partner with business continuity and IT recovery owners to maintain and test business continuity and disaster recovery plans, with emphasis on cyber incidents, data restoration and critical banking services.Governance and Reporting Provide clear reporting to senior management, the IT Steering Committee and the board or designated board committee on security risks, incidents, control effectiveness and remediation progress. Maintain a documented escalation path for significant risks and unresolved findings, including direct access to the designated executive or board committee when needed for independent escalation. Recommend security priorities, staffing, training and budget needs; present risk treatment options and obtain documented risk acceptance from authorized management.Acquisition and Deployment Maintain awareness of emerging threats, attack methods, security technologies and financial services risks; recommend practical improvements appropriate to the bank's size and complexity. Evaluate and recommend security solutions and enhancements through approved procurement and vendor management processes, considering effectiveness, integration, support and total cost. Oversee deployment, integration, configuration and validation of security solutions in coordination with IT teams and service providers. Review new systems, cloud services, digital banking integrations, automation and AI use cases for security and data protection risks before implementation.Security Operations and Incident Response Oversee monitoring and protection of endpoints, servers, networks, cloud services, email, identities and data repositories through internal resources and managed providers. Coordinate security controls for identity and access management, multifactor authentication, privileged access, remote access, encryption and data protection; oversee periodic access reviews. Oversee vulnerability scanning, penetration testing and security assessments; prioritize findings by risk, coordinate remediation with system owners and verify closure. Monitor adherence to security policies and configuration standards; track exceptions and coordinate corrective actions with responsible teams. Lead the bank's response to suspected or confirmed information security incidents, coordinating investigation, containment, recovery, evidence preservation and lessons learned. Maintain and exercise the incident response plan; coordinate timely escalation and communications with leadership, Compliance, legal counsel, insurers and response providers, as appropriate. Work with Compliance and legal counsel to assess notification obligations and support timely, approved communications to regulators, customers and other affected parties. Oversee managed security service performance, escalation procedures and coverage; verify that alerts, investigations and corrective actions receive appropriate follow-through.Audit Compliance and Third Party Risk Serve as a primary security contact for examinations, internal and external audits, and independent assessments; coordinate evidence, responses and remediation tracking. Partner with Compliance and Risk Management to align the security program with applicable banking requirements, FFIEC guidance and recognized frameworks such as NIST CSF. Support vendor management through security due diligence, review of assurance reports and testing results, assessment of access and data handling, and ongoing monitoring of critical providers. Ensure independent testing and audit activities remain separate from the design and operation of controls being assessed. Skills and AbilitiesStrong decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate oneAn ability to effectively influence others to modify their opinions, plans or behaviorsAn understanding of organizational mission, values, goals and consistent application of this knowledgeStrong problem-solving, critical thinking and troubleshooting skillsAbility to establish and maintain effective working relationships with othersAble to exercise independent judgment and act on it.Excellent analytical, mathematical, and creative problem-solving skillsExcellent listening, interpersonal, written, and oral communication skillsLogical and efficient, with keen attention to detailHighly self-motivated and directed.Ability to effectively prioritize and execute tasks while under pressure.Strong customer service orientationExperience working in a team-oriented, collaborative environment. Education, Training, and ExperienceRequired Qualifications Bachelor's degree in information security, information technology, computer science or a related field, or an equivalent combination of relevant education and professional experience. At least five years of progressive experience in information security or IT risk, including responsibility for security program activities, incident response or control oversight. Experience coordinating security initiatives across teams and managing external security providers or comparable service relationships. Working knowledge of security risk assessments, vulnerability management, identity and access controls, endpoint protection, network security, cloud security and incident response. Ability to develop practical policies, interpret assessment findings, prioritize remediation and maintain clear documentation. Strong judgment, organizational skills and the ability to explain security risks and recommendations to business leaders.Preferred Qualifications Experience in a community bank, financial institution or another regulated environment, including participation in audits or regulatory examinations. Knowledge of GLBA information security requirements, FFIEC guidance, NIST Cybersecurity Framework and third-party risk management practices. CISSP, CISM, CRISC or a comparable information security certification. Experience supervising staff or leading an information security program, including management and board reporting. Experience with Microsoft 365 and Entra ID, endpoint detection and response, SIEM or managed detection services, privileged access management, firewalls, secure remote access and recovery technologies. Equal Opportunity Employer/Disability/Veterans. Richwood Bank is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Candidates are subject to background and credit checks. Employement is contingent upon results that meet company standards and applicable laws.