Business Information Security Officer

Chevron Federal Credit Union is one of the top-run credit unions in the country – and one of the largest, with $5 billion in assets. Yet our corporate culture is not stuffy: the Team Spirit Committee runs fun activities and charitable events throughout the year, and work-life balance, mutual respect, diversity, and providing a voice for every employee are all important to us. As you might imagine, we provide competitive pay and great benefits, including:

• Bonus/incentives for all regular employees
• 401(k) with 8% company contribution
• Medical, dental, and vision insurance for employees and dependents paid at 80%
• PTO and paid sabbaticals
• Tuition reimbursement

GENERAL SUMMARY

The Business Information Security Officer is responsible for overseeing and implementing the information security program to protect the Credit Union’s assets, data, and infrastructure. This role encompasses information security program development and management, risk management and mitigation, security operations, and incident management and ensures compliance with industry standards and regulations.

Position Duties & Functions

Program Management/Leadership

• Responsible for aligning security initiatives with enterprise programs and business objectives and ensuring that information assets and technologies are adequately protected. 
• Develops and implements a comprehensive information security program to protect the Credit Union’s assets, infrastructure, and sensitive information.
• Drives the integration of security best practices into business processes and projects.
• Chairs the Information Security Council, bringing together key stakeholders from various departments to collaboratively shape and execute our security strategy.
• Collaborates with information security and cybersecurity counterparts in providing functional leadership and expertise to manage the security program and ensure consistent, effective implementation of best practices, policy, and procedures.
• Provides routine updates on security trends internal and external to the Credit Union and works with business management to prioritize initiatives and spending to reduce information security risk and improve the overall information security program.
• Ensures compliance with policies, regulations and laws.

Risk Management

• Responsible for assessment and mitigation of enterprise-wide information risk, including control monitoring, issue escalation, root-cause analysis, and development of risk responses.
• Conducts regular security risk assessments and control audits to identify vulnerabilities and ensure compliance with regulatory requirements.
• Identifies, assesses, and prioritizes information security risks and implements strategies to mitigate risks.
• Conducts annual information security asset-based risk assessment to identify and prioritize risks associated with our information assets and develop mitigation strategies with asset owners.
• Partners with business management to determine acceptable information security risk levels for the enterprise, including development of key risk indicator and risk appetite metrics.
• Ensures data privacy through development of proactive monitoring controls.
• Works with business to ensure least privilege principles are applied, enforced, and reviewed.
• Monitors completeness, timeliness, and accuracy of application entitlement reviews and drives control enhancements.

Vendor Management

• Evaluates the information security posture of third-party vendors to inform vendor selection process.
• Supports the annual vendor management due diligence cybersecurity and information security assessments for critical and high-risk vendors with access to sensitive information or sensitive systems.
• Collaborates with vendor management and legal counsel to ensure contracts include necessary security clauses and provisions.
• Ensures third-party vendor onboarding and offboarding adhere to rigorous security standards to safeguard our data, information, and systems.
• Works with internal departments and third-party vendors to ensure compliance and adherence to data minimization processes, data handling practices, security controls, and relevant regulations.
• Collaborates with IT and technology teams to select, implement, and manage security technologies, such as firewalls, intrusion detection systems, encryption tools, and access controls.
• Oversees and evaluates third-party vendor security, with expertise in administrating SIGLITES and conducting thorough review of SIGLITES and SOC2 reports to assess the security posture of external partners.

P