Director, Information Security

Overview

The Director, Information Security is BluPeak’s leader in enterprise information security, maintaining, enhancing and administering the Information Security Policy and Program. This role champions the protection of member data and sensitive business information while ensuring the integrity and confidentiality of all BluPeak technology systems, encompassing computers, cloud-hosted services, databases, storage systems, websites, custom software development, and secure data transfers. This role ensures BluPeak can successfully adapt and respond to sophisticated, emerging threats.

A critical position within our Risk Management team, the Director, Information Security will serve as the Information Security Officer and is responsible for second-line risk oversight responsibilities requiring an understanding of a variety of technologies in place at BluPeak, as well as regulations, standards, and guidelines that influence the security program. The Director maintains a comprehensive understanding of the technologies, systems, information assets, and third-party services that support the credit union’s operations and evaluates the associated risks, control effectiveness, and alignment with applicable regulatory requirements and industry standards. The role provides independent risk assessment, monitoring, challenge, and reporting to management and appropriate governance committees, while partnering with first-line technology and business teams to strengthen security practices and ensure risks are identified, appropriately managed, and escalated when necessary.

This role collaborates with senior leadership to align security initiatives with organizationalgoals, partners with the third party risk management team to safely onboard and monitor vendors, manages security training programs, supports a culture of security, and drives the cybersecurity program to ensure a robust, forward-looking security posture.

Responsibilities

Cybersecurity Strategy, Governance, and Leadership • Serve as BluPeak’s cybersecurity advisor, engaging with committees, working groups, senior leadership, and key stakeholders to develop, govern, and continuously mature a cybersecurity program that is fully integrated with business goals, compliance mandates, risk management frameworks, and the credit union's overarching strategic vision.• Maintain a robust and resilient security posture in response to emerging and sophisticated threats appropriate to the changing business environment.

• Manage the development and continuous improvement of the Information Security Policy and Program, ensuring alignment with industry standards, regulatory requirements and guidelines such as the Gramm Leach Bliley Act (GLBA), FDIC, NCUA, CIS, NIST, and PCI. • Prepare and present the annual Information Security Program report to the Board of Directors, detailing program status, risk assessments, and forward-looking initiatives.• Manage and develop information security program-related policies and procedures for presentation to the Information Technology Steering Committee.• Administer the security risk assessment, identifying vulnerabilities and prioritizing remediation efforts in partnership with relevant stakeholders.• Act as a subject matter expert in AI and emerging-technology risk governance and provide input on the security budget.• Establish and monitor security metrics/KRIs and provide input on the security budget.

Information Security Program and Risk Management

• Manage the development and continuous improvement of the Information Security Policy and Program, ensuring alignment with industry standards, regulatory requirements, and guidelines such as GLBA, FDIC, NCUA, CIS, NIST, and PCI.• Administer the security risk assessment process, identifying vulnerabilities and prioritizing remediation efforts in partnership with relevant stakeholders.• Serve as the expert over third-party information security risk management, directing due diligence, SOC 1 and SOC 2 report evaluations, and validation of user control requirements across vendors, fintechs, hosted services, managed services, and critical technology partners.• Perform identity and access governance reviews, collaborate with technology leaders to maintain data classification, oversee cloud security, and consult on security reviews for projects and changes.• Act as liaison to regulators, examiners, and external auditors as it pertains to information security.• Administer security policy exceptions for BluPeak employees, including OCONUS travel, software requests, and DLP website whitelisting, through established approval processes.

Security Operations, Incident Response, and Threat Management

• Oversee BluPeak’s information security incident response framework, providing risk oversight and monitoring response efforts, investigations, and root cause analyses to ensure appropriate escalation, remediation, and reporting.• Manage vulnerability reporting, ensuring timely identification and remediation of system vulnerabilities.• Oversee BluPeak’s critical cybersecurity technology stack, including SIEM, antivirus/antimalware, and endpoint protection solutions, in collaboration with internal teams and external vendors to support security monitoring, threat detection, incident response, and adherence to cybersecurity policies and protocols.• Provide threat intelligence and cyber insurance support.• Monitor and promptly escalate critical and high-risk security issues and vulnerabilities to the appropriate committees and management staff, while recommending and advocating for appropriate solutions and actions.

Training, Collaboration, and Business Integration

• Manage a robust employee security awareness training program, including education, testing, and compliance reporting.• Build and manage partnerships with internal departments to ensure security considerations are integrated into business processes, system designs, and technology deployments.• Participate in special projects as assigned.• Other duties may be assigned.

Compliance • Adhere to company policy and procedure, complete annual compliance training, and comply with business continuity and vendor management policy. These are crucial to the success of the organization and have regulatory compliance and/or safety and soundness for the sustainability of the credit union. Embrace BluPeak’s core values.• Comply with all Anti Money Laundering laws such as the Bank Secrecy Act, OFAC and USAPATRIOT Act and all related policies and procedures including accurate Member/Customer Identification Program, member due diligence, accurate OFAC match processing, and reporting unusual activities and suspected fraud.

LEADERSHIP RESPONSIBILITIES • Directly supervise up to two employees. Ensure supervisory responsibilities are carried out effectively and in accordance with organizational policies and applicable laws. • Champion BluPeak's culture, purpose, and values by leading with integrity, accountability, and collaboration.

Qualifications

EDUCATION and/or EXPERIENCE • Bachelor’s degree in information technology, cybersecurity, information systems, or a closely related field required. • Minimum of three (3) years of relevant professional experience in information security, cybersecurity, or closely related disciplines; or• Associate degree or certificate in a closely related field, plus at least five (5) years of relevant professional experience; or• Minimum of (7) years of demonstrated relevant professional experience in cybersecurity, information security, security governance, or closely related disciplines, in lieu of a degree or certificate.• Financial, Medical, DOD, or other highly regulated experience required.

Demonstrated expertise in the following areas is required:

• Network and data security practices and policies• Incident prevention and response management• Auditing/testing/regulatory exams• Governance Risk & Compliance (GRC) frameworks• Third party risk management

TECHNOLOGY PROFICIENCY • To perform this job, the employee must possess applicable technology skills. Must possess advanced knowledge of network and endpoint security, cloud, IAM, SIEM/logging, vulnerability management and vendor risk.

CERTIFICATES, LICENSES, REGISTRATIONS • CISSP, CISA, CISM, GIAC, CRISC preferred.

OTHER QUALIFICATIONS • Must be able to work with highly confidential information in a discretionary manner.• Must have superb analytical & executive communication skills. Strong communication skills (written, verbal and listening); ability to communicate effectively with all staff or varying technical expertise. Must have a high level of organization and prioritization.• Work outside of standard business hours (evenings, weekends, holidays) may be required, as needed.

WORK ENVIRONMENT/CULTURE Embodies and advances BluPeak's culture by fostering an environment rooted in accountability, high performance, and genuine connection to the organization's purpose and vision. Champions a workplace where professionalism and authenticity coexist — where employees feel empowered to show up fully, contribute meaningfully, find meaning in their work, celebrate wins and enjoy the journey alongside their team.

BluPeak Federal Credit Union is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex including sexual orientation and gender identity, national origin, disability, protected Veteran Status, or any other characteristic protected by applicable federal, state, or local law. Employment may be contingent upon BluPeak Credit Union’s receipt of an acceptable and job-related background check, drug screen and credit check, as applicable and permissible by law. BluPeak Credit Union is committed to working and providing reasonable accommodation to applicants with physical, mental disabilities and sincerely held religious beliefs. For more information, contact Human Resources.

PM17

Min

USD $130,000.00/Yr.

Max

USD $150,000.00/Yr.