Manager, Information Security

Under the direction of the Sr. AVP, Information Security, plans, organizes, integrates, manages, and evaluates the day-to-day activities of the Credit Unions Information Security Department; while maintaining the advanced technical knowledge and hands-on capabilities necessary to support security operations; administers, plans and manages the acquisition, installation and maintenance of the Credit Unions information security infrastructure; including security information and event management (SIEM), and threat intelligence systems to detect and monitor intrusions; secures data, monitors system usage and manages rules and permissions for access. Maintains the technical capability to directly support complex security investigations, incidents, and operational activities when needed. Oversees planning and implementation of strategic plans; ensures projects are designed and implemented efficiently and effectively; directs departmental business continuity planning to minimize risk. Possesses a strong technical background and understands risk, mitigation, and technical controls. Manages security controls to maintain an organization-wide information security program to preserve the availability, integrity, and confidentiality of the Credit Union's information assets. Participates as a member of the Cybersecurity Incident Response team during security events and serves as a backup on the change management team. ## Job Description Essential Duties and Responsibilities - Provides leadership and works with staff to develop and retain highly competent, member service-oriented staff through training and day-to-day management practices that support the Credit Unions mission and strategic goals. Mentors security team and places a heavy emphasis on employee retention. - Establishes performance requirements and objectives for staff; monitors and evaluates their performance; provides coaching and development opportunities; finds ways to recognize performance; addresses performance deficiencies and takes disciplinary action, if warranted, in accordance with Credit Unions policies and procedures. - Plans, organizes, evaluates, and manages the work of staff within the department; utilizes resources effectively; implements plans, programs and work processes and procedures necessary to achieve designated results; coordinates and integrates functions within the department and across the Credit Union. - Leads the team to implement secure enterprise systems and identifies issues that could compromise data confidentiality, integrity, and availability. - Develops and recommends a variety of security management policies, protocols, systems, and tools, including but not limited to, endpoint security, next gen AV software, EDR solution, cloud security tools, web content filters; network security policies, vulnerability and patch management program and remote access standards guidelines; ensuring compliance with NCUA regulations. - Manages the technical performance of security monitoring and logging systems, ensuring, reliability of information security alerts; manages adherence with log retention standards; reviewing and reporting incidents requirements; evaluates the vendor-provided patches and upgrades; coordinates the remediation of vulnerability problems with the Technology Division staff, and vendors. - Oversees security monitoring and detection activities across SIEM, firewall, endpoint, cloud, and other security technologies, ensures significant security events and suspicious activity are appropriately investigated, escalated, documented and remediated; establishes operational priorities and provides management oversight of security investigations. - Serves as an internal information security consultant by reviewing all system related security controls for current and future systems and products and identifies issues that could compromise data integrity or security. - Responds, in a timely manner, to informatio security incidents to minimize potential losses of information assets. - Collaborate with FS-ISAC and other intelligence sharing agencies ensuring threat intelligence capabilities and information sharing are effectively implemented and delivering value to the business. - Ensures audit trails, system logs, and other monitoring data sources are reviewed periodically and comply with policies and procedures and audit requirements. - Oversees, directs, and enhances the security operational functions to detect, analyze, respond to and track information security threats and vulnerabilities. - Identifies, prioritizes, and sponsors opportunities for security automation, orchestration, and process improvement to improve operational efficiency, strengthen controls and allow staff to focus on higher-risk and higher-value activities - Recommends necessary changes to the Information Security Program to ensure the confidentiality, integrity and availability of information assets; ensures proper data classification and compliance; maintains an ongoing security awareness program and ensure full compliance with regulatory requirements and privacy laws. - Serves as a member of the Cybersecurity Incident Response Team during security events and provides management coordination and operational leadership during security events; serve as a backup to the Sr. AVP of Information Security on the change management team. - Acts as a change agent and drives the department and business forward using effective management, analysis, and strategic skills. - Evaluates and provides management direction for significant security technology upgrades, enhancements, architectural changes, and control improvements.. - Oversees implementation and effectiveness for cloud-based environments, including but not limited to AWS, Azure, and other cloud platforms used by RFCU and vendors. - Analyzes technologies and establishes highly effective processes and protocols to ensure comprehensive protection exists to prevent unauthorized entry into the company networks and systems. - Actively recruits and leads by example to create a culture where employees want to work and places a heavy emphasis on employee retention. Company Wide Expectations Maintains a professional image and demeanor at all times, consistently demonstrating Credit Union RISE Values and adhering to the Code of Ethics. Delivers friendly, caring service to internal and external members. Complies with all applicable State, Federal and NCUA rules and regulations and all Credit Union policies and procedures. Follow all physical and online security procedures and maintain strict confidentiality of all member information. Completes all required regulatory and compliance training and maintains required knowledge of Credit Union products and services. Works scheduled hours and maintains punctuality. Performs other related duties as assigned or requested. EDUCATION/EXPERIENCE Minimum Qualifications To perform this job satisfactorily, an employee must be able to carry out each essential duty competently. The requirements listed below are representative of the education, experience, skills and abilities required. An equivalent combination of education and experience may be considered.