CISO - Chief Information Security Officer

WHO ARE WE : Alerus is a commercial wealth bank and national retirement provider with one core purpose: helping clients achieve their financial goals. We value the expertise and skillsets each team member provides and encourage collaboration, innovation, adaptability, and an entrepreneurial spirit at all levels of our company. The Vice President, Chief Information Security Officer (CISO) is the senior executive responsible for establishing, leading, and continuously maturing the organization’s enterprise‑wide information security strategy reporting directly to the Chief Risk Officer. This role oversees the development, implementation, and governance of security policies, programs, and technologies designed to protect the confidentiality, integrity, and availability of customer, employee, and institutional data across all lines of business. The CISO operates closely with senior leadership, technology teams, risk functions, and business units to ensure security is embedded into organizational strategy, operations, and culture. The CISO will be a part of IT Management to ensure the Company’s technology environment matures and evolves to mitigate current and future information security risks. This position serves as the primary resource for cybersecurity to executive management, the Board of Directors, and bank regulators, and acts as a trusted advisor on emerging cyber threats, technology risk, and digital resilience. Develop, implement, and continuously update the company’s multi-year information security strategy, roadmap, and operating plan consistent with business objectives and risk appetite; define measurable outcomes and security program maturity targets. Establish and maintain information security policies, standards, and procedures aligned with applicable banking laws and regulations and recognized frameworks, including FFIEC guidance, the NIST Cybersecurity Framework, and CIS Controls. Ensure systems compliance with security policies, standards, and practices. Recommend and direct the implementation of solutions for non-compliant systems. Establish enterprise security architecture requirements across cloud, on-premises, third-party, and hybrid environments; conduct or approve security design reviews for material technology changes. Monitor the evolving threat and regulatory environment, including risks arising from cloud, artificial intelligence, and digital banking technologies; Direct vulnerability management, penetration testing, attack-surface management, and remediation governance, including risk-based prioritization and escalation of overdue critical issues. Direct security operations, threat intelligence, threat hunting, monitoring, detection, and response activities, including the effective oversight of managed security service providers. Own, maintain, and regularly test the company’s Computer Security Incident Response Plan through tabletop exercises and simulations; serve as executive incident commander for material events and coordinate containment, recovery, communications, regulatory notifications, and post-incident reviews with Legal, Compliance, Fraud, Risk, and business leaders. Lead and advise on control framework for identity and access management, data classification, encryption, data loss prevention, endpoint and network security, cloud security, application security, and secure software development and DevSecOps control frameworks. Lead enterprise cybersecurity risk assessments and security program maturity assessments; identify critical systems, data, and business services and verify that risk treatment plans and controls provide appropriate protection. Own the information security budget, workforce plan, and external service strategy; work with IT leadership team and business leaders to prioritize investments based on risk reduction, business impact, regulatory expectations, and sound financial analysis. Lead cybersecurity oversight across the third-party lifecycle, including due diligence, contract security requirements, ongoing monitoring, concentration and supply-chain risk, issue remediation, and secure termination. Serve as the primary cybersecurity subject matter expert and point of contact for internal and external audits and regulatory examinations; Partner with Business Continuity, Technology, Operations, and Risk to establish and regularly test cyber recovery, disaster recovery, and operational resilience plans for critical business services and technology dependencies. Collaborate with Legal and Compliance to ensure ongoing compliance with GLBA Section 501(b) and related Interagency Guidelines, PCI DSS, Sarbanes-Oxley requirements, and applicable state privacy and breach-notification laws. Maintain documentation and evidence necessary to demonstrate control design and operating effectiveness during regulatory reviews, audits, client due diligence, and cyber insurance underwriting. Partner with Enterprise Risk to develop, validate, and report key risk indicators, key performance indicators, control effectiveness, program maturity, material issues, and remediation aging to the Enterprise Risk Management Committee and Risk Committee. Partner with Risk to ensure cyber risk is appropriately incorporated into the Bank's overall risk appetite statement and ERM framework. Present quarterly, or more frequently as needed, to the Board Risk Committee on cybersecurity risk posture, program effectiveness and maturity, roadmap progress, emerging threats, material incidents, regulatory posture, and investment priorities. Provide clear, board-appropriate cybersecurity risk reporting and translate technical risk into business impact for non-technical stakeholders. Design and oversee an enterprise security awareness and role-based training program, including phishing simulations and effectiveness measures that reflect current threats and employee responsibilities. Build, lead, and develop a high-performing information security team, including succession planning and staff development. Partner with Data, Technology, Legal, Compliance, and Risk leaders to establish security requirements and governance for artificial intelligence systems and third-party AI tools, including data use, access, monitoring, and incident response. Bachelor’s degree in computer science, cybersecurity, management information systems, or a related field, or an equivalent combination of education and relevant experience.

• 10+ years of progressive information security experience, with at least 5 years in a leadership role.
• Demonstrated experience building and maturing an enterprise information security program in a regulated financial institution or comparably regulated environment.
• Executive-level communication and influence skills, including experience translating technical risk into business impact for executive leadership, board committees, regulators, and non-technical stakeholders.
• Experience leading enterprise cyber risk assessments, security architecture, vulnerability management, penetration testing, remediation governance, and control-effectiveness testing.
• Experience with developing and providing an information security awareness and training program.
• Experience with developing and maintaining information security policies and standards.
• Demonstrated command of the NIST Cybersecurity Framework, FFIEC IT Examination Handbook guidance, CIS Controls, and banking regulatory expectations; Practical technical depth in cloud and hybrid architecture, network and endpoint security, identity and access management, encryption, data protection, application security, and secure software development.
• Knowledge of GLBA Section 501(b), related Interagency Guidelines, PCI DSS, Sarbanes-Oxley requirements, state privacy and breach-notification laws, and relevant federal and state banking regulatory expectations.
• Current Certified Information Systems Security Professional certification; Experience leading information security within banking, wealth management, retirement services, payments, or another regulated financial services organization.

Experience with banking regulatory examinations, audit remediation, and executive and board reporting. Hands-on leadership experience in cloud security, secure architecture, DevSecOps, and technology transformation. Experience building security teams and effectively managing co-sourced security capabilities, managed security service providers, and specialized consultants. Competitive compensation including base salary, bonus and/or incentive opportunities. Comprehensive benefits package providing a wide range of health and well-being benefits, including medical, dental, vision, life and long-term disability insurance; and 401(k) and ESOP for retirement savings. Generous paid time off programs such as flexible time off, company-paid holidays, parental and bereavement leave. Learning and development resources for personal and professional career development, and advancement opportunities. Access to financial experts for guidance, financial wellness tools, and discounts on Alerus products and services. Support for the communities we live in through paid volunteer time and a company donation match opportunity. Work is typically performed in an office setting. The employee is occasionally required to move about the office utilizing proper ergonomic safeguards when doing so. Additionally, the employee must occasionally lift or move supplies and materials up to 20 pounds. Alerus is an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.