Chief Information Security Officer

Vice President, Chief Information Security Officer (CISO)

Alerus is a commercial wealth bank and national retirement provider with one core purpose: helping clients achieve their financial goals. We are driven by a shared commitment to always do the right thing; leading with integrity and providing valued advice and guidance to our clients. We value the expertise and skillsets each team member provides and encourage collaboration, innovation, adaptability, and an entrepreneurial spirit at all levels of our company. By consistently seeking improvements and growth, we foster long-term relationships with clients and team members. We are proud to be recognized as a Top Workplace by numerous industry and regional outlets.

Our core values are: Passion for Excellence :: Success is Never Final :: Do the Right Thing :: One Alerus

About the Role:

The Vice President, Chief Information Security Officer (CISO) is the senior executive responsible for establishing, leading, and continuously maturing the organization's enterprise-wide information security strategy reporting directly to the Chief Risk Officer. This role oversees the development, implementation, and governance of security policies, programs, and technologies designed to protect the confidentiality, integrity, and availability of customer, employee, and institutional data across all lines of business. The CISO operates closely with senior leadership, technology teams, risk functions, and business units to ensure security is embedded into organizational strategy, operations, and culture. The CISO will be a part of IT Management to ensure the Company's technology environment matures and evolves to mitigate current and future information security risks. This position serves as the primary resource for cybersecurity to executive management, the Board of Directors, and bank regulators, and acts as a trusted advisor on emerging cyber threats, technology risk, and digital resilience.

What You'll Be Doing:

• Develop, implement, and continuously update the company's multi-year information security strategy, roadmap, and operating plan consistent with business objectives and risk appetite; define measurable outcomes and security program maturity targets.
• Establish and maintain information security policies, standards, and procedures aligned with applicable banking laws and regulations and recognized frameworks, including FFIEC guidance, the NIST Cybersecurity Framework, and CIS Controls.
• Ensure systems compliance with security policies, standards, and practices. Recommend and direct the implementation of solutions for non-compliant systems.
• Establish enterprise security architecture requirements across cloud, on-premises, third-party, and hybrid environments; conduct or approve security design reviews for material technology changes.
• Monitor the evolving threat and regulatory environment, including risks arising from cloud, artificial intelligence, and digital banking technologies; adjust strategy, controls, and resourcing accordingly and advise cross functional leadership on impacts to the company.
• Direct vulnerability management, penetration testing, attack-surface management, and remediation governance, including risk-based prioritization and escalation of overdue critical issues.
• Direct security operations, threat intelligence, threat hunting, monitoring, detection, and response activities, including the effective oversight of managed security service providers.
• Own, maintain, and regularly test the company's Computer Security Incident Response Plan through tabletop exercises and simulations; serve as executive incident commander for material events and coordinate containment, recovery, communications, regulatory notifications, and post-incident reviews with Legal, Compliance, Fraud, Risk, and business leaders.
• Lead and advise on control framework for identity and access management, data classification, encryption, data loss prevention, endpoint and network security, cloud security, application security, and secure software development and DevSecOps control frameworks.
• Lead enterprise cybersecurity risk assessments and security program maturity assessments; identify critical systems, data, and business services and verify that risk treatment plans and controls provide appropriate protection.
• Own the information security budget, workforce plan, and external service strategy; work with IT leadership team and business leaders to prioritize investments based on risk reduction, business impact, regulatory expectations, and sound financial analysis.
• Lead cybersecurity oversight across the third-party lifecycle, including due diligence, contract security requirements, ongoing monitoring, concentration and supply-chain risk, issue remediation, and secure termination.
• Serve as the primary cybersecurity subject matter expert and point of contact for internal and external audits and regulatory examinations; coordinate responses to findings, corrective action plans, and remediation timelines with Internal Audit and external auditors and examiners.
• Partner with Business Continuity, Technology, Operations, and Risk to establish and regularly test cyber recovery, disaster recovery, and operational resilience plans for critical business services and technology dependencies.
• Collaborate with Legal and Compliance to ensure ongoing compliance with GLBA Section 501(b) and related Interagency Guidelines, PCI DSS, Sarbanes-Oxley requirements, and applicable state privacy and breach-notification laws.
• Maintain documentation and evidence necessary to demonstrate control design and operating effectiveness during regulatory reviews, audits, client due diligence, and cyber insurance underwriting.
• Partner with Enterprise Risk to develop, validate, and report key risk indicators, key performance indicators, control effectiveness, program maturity, material issues, and remediation aging to the Enterprise Risk Management Committee and Risk Committee.
• Partner with Risk to ensure cyber risk is appropriately incorporated into the Bank's overall risk appetite statement and ERM framework.
• Present quarterly, or more frequently as needed, to the Board Risk Committee on cybersecurity risk posture, program effectiveness and maturity, roadmap progress, emerging threats, material incidents, regulatory posture, and investment priorities.
• Provide clear, board-appropriate cybersecurity risk reporting and translate technical risk into business impact for non-technical stakeholders.
• Design and oversee an enterprise security awareness and role-based training program, including phishing simulations and effectiveness measures that reflect current threats and employee responsibilities.
• Build, lead, and develop a high-performing information security team, including succession planning and staff development.
• Partner with Data, Technology, Legal, Compliance, and Risk leaders to establish security requirements and governance for artificial intelligence systems and third-party AI tools, including data use, access, monitoring, and incident response.
• Other duties as assigned.

What You Should Have:

• Bachelor's degree in computer science, cybersecurity, management information systems, or a related field, or an equivalent combination of education and relevant experience.
• 10+ years of progressive information security experience, with at least 5 years in a leadership role.
• Demonstrated experience building and maturing an enterprise information security program in a regulated financial institution or comparably regulated environment.
• Executive-level communication and influence skills, including experience translating technical risk into business impact for executive leadership, board committees, regulators, and non-technical stakeholders.
• Experience leading enterprise cyber risk assessments, security architecture, vulnerability management, penetration testing, remediation governance, and control-effectiveness testing.
• Experience with developing and providing an information security awareness and training program.
• Experience with developing and maintaining information security policies and standards.
• Demonstrated command of the NIST Cybersecurity Framework, FFIEC IT Examination Handbook guidance, CIS Controls, and banking regulatory expectations; working knowledge of ISO 27001 and SOC 2.
• Practical technical depth in cloud and hybrid architecture, network and endpoint security, identity and access management, encryption, data protection, application security, and secure software development.
• Knowledge of GLBA Section 501(b), related Interagency Guidelines, PCI DSS, Sarbanes-Oxley requirements, state privacy and breach-notification laws, and relevant federal and state banking regulatory expectations.
• Current Certified Information Systems Security Professional certification; CISM, CISA, CRISC, or CCSP certification preferred.

Preferred Attributes:

• Experience leading information security within banking, wealth management, retirement services, payments, or another regulated financial services organization.
• Experience with banking regulatory examinations, audit remediation, and executive and board reporting.
• Hands-on leadership experience in cloud security, secure architecture, DevSecOps, and technology transformation.
• High ethical standards, sound judgment under pressure, and a strong commitment to protecting clients and the company.
• Experience building security teams and effectively managing co-sourced security capabilities, managed security service providers, and specialized consultants.

What We Bring To The Table:

• Competitive compensation including base salary, bonus and/or incentive opportunities.
• Comprehensive benefits package providing a wide range of health and well-being benefits, including medical, dental, vision, life and long-term disability insurance; and 401(k) and ESOP for retirement savings.
• Generous paid time off programs such as flexible time off, company-paid holidays, parental and bereavement leave.
• Learning and development resources for personal and professional career