VP, Cyber Assurance & Defense

If you are ready to join a company that truly cares about its employees, our members, and our community then you have come to the right place!Summary of Role:TheVice President of Cyber Assurance and Defenseis responsible for designing, operating, and maturing acomprehensive, riskbased cyber assurance and defense programfor a complex, highly regulated financial institution. This role ensures Broadview Federal Credit Union (BFCU) maintainsstrong defensive and offensive cyber capabilities, arobust access access governance, andmeasurable cyber risk reductionaligned with regulatory expectations, business strategy, and member protection.This position is responsible for thesecondline technical cyberassurance and defense function, providing independent oversight, challenge, and assurance over controls, while partnering closely with IT, Engineering, and Business leadership. The VP willmature an evolving programinto arepeatable, defensible, regulatorready capabilitysuitable for CFPBscale supervision or a best-in-class organization.The role requires adeep technical hands on expertise across modern security tooling, cloud and SaaS platforms, offensive security, digital forensics, SIEM/SOC operations, identity governance, and incident response combined with the ability to to translate cyber risk intobusiness and regulatory terms.Essential Job Functions/Responsibilities:Cyber Assurance & Defense Leadership * Provide oversight of theCyber Assurance & Defense function (includes Cyber Defense and Identity Governance), encompassing: * Defensive security monitoring and detection * Offensive security (penetration testing, red/purple teaming) * Digital forensics and investigations * Identity and Access governance (IAG) * Act as the technical security expert, independently validating initiatives/ project situations, security control design, effectiveness, and sustainability.Program Maturity & Continuous Improvement * Design and execute amultiyear cybersecurity maturity roadmapaddressing: * Vulnerability and exposure management * Security architecture and technical design reviews * Security tool rationalization and roadmap planning * Early warning detection capabilities using SIEM and UEBA * Deception technologies and advanced detection engineering * Mature security capabilities fromadhoc to defined, repeatable, and measurable, with regulator defensible documentation and evidence.Cyber Defense, Detection & Incident Response (IR) * Enhance and oversee theCybersecurity Incident Response Team (CIRT)program, including: * Maintain updated IR plans, playbooks, and runbooks to align with evolving threats * Define roles and escalation paths * Executive and regulator communication standards * Tabletop exercises and live simulations * Oversee forensic investigations involving: * Endpoint, network, cloud, and SaaS platforms * Insider threat activity * Credential misuse and account compromise * Ensure lessons learned are operationalized into control improvements. * Support SVP Information Risk and Security managing incident responseIdentity & Access Governance (IAG) * Architect and lead acentralized enterprise IAG program, including: * Encourage Role Based Access Control (RBAC) * Least privilege enforcement * Segregation of duties (SoD) * Privileged Access Management (PAM) * Assess, select, and implementuser access governance platformsappropriate for financial services scale and risk. * Centralize access risk decisions based onapplication criticality, data sensitivity, and regulatory impact.Risk Identification, Assessment & Reporting * Identify emerging cyber threats and systemic risks impacting: * Core banking systems * Cloud (AWS) and SaaS platforms (Microsoft 365) * Digital channels and member facing technologies * Translate technical findings intoclear risk statementswith prioritized remediation recommendations. * Develop cyber risk metrics, KRIs, and