Information Security Manager

• This position will be in office at our Murray, Utah location.

FinWise Bank is a commercial institution located in Murray, Utah that offers exceptional products in a manner that continually surpasses expectations. Information Security is a vital part of the Bank’s structure, and the Risk and Compliance Division supports the Bank in these efforts. The Information Security Manager will work closely with the VP, Information Security Officer (ISO) to promote Information Security standards, controls, and best practices across the Bank. This role will be responsible for  monitoring the security posture of Strategic Partners, conducting due diligence reviews of third parties with access to the Bank’s sensitive data. This role will also have oversight activities of the Information Technology Division. This will be accomplished by monitoring security measures for the protection of computing networks and data delivery systems used throughout the Bank.

Tasks:

• Serve as the primary point of contact between the Bank and assigned Strategic Partners for all matters related to Information Security.
• Provide visibility to the ISO about the security posture of assigned Strategic Partners.
• Monitor that assigned Strategic Partners are providing expected oversight documentation.
• Escalate all assigned Strategic Partner issues to the ISO.
• Participate in annual virtual or onsite visits of assigned Strategic Partners.
• Review policies, plans, procedures, security assessments, monitoring alerts, architectural diagrams, testing results, and audits from assigned Strategic Partners to ensure compliance with applicable banking regulations using a risk-based approach.
• Develop strong and collaborative professional relationships with Program Management, Vendor Management, IT teams at FinWise Bank as well as counterparts at Strategic Partners.
• Review and assess the security posture of third parties by evaluating submitted evidence and requesting additional documentation when appropriate.
• Create, modify, and enhance Information Security procedures and provide them to the ISO for review and approval.
• Execute assigned Information Security tasks in a timely manner.
• Escalate observed security issues, control gaps, or deficient third parties to the ISO.
• Complete user access reviews of assigned Bank systems.
• Conduct clean desk reviews at Bank premises.
• Conduct investigations of security incidents leveraging the Bank’s security tools.
• Ensure that security incidents associated with the Bank, third parties, or Strategic Partners are documented.
• Other duties as assigned.

Knowledge, Skills, and Abilities:

• Manage concurrent activities with tight deliverables and a strong attention to detail.
• Ability to handle highly confidential information and material in a professional manner.
• Ability to communicate technical information in a manner comprehensible by individuals at varying degrees of experience and skill levels.
• Outstanding technical security background as well as thorough understanding of relevant risk mitigation and technical controls following industry best practices from NIST, CIS, etc.
• Direct experience with controls related to Information Security as defined by the FFIEC, FDIC, GLBA, SEC, SOX, PCI-DSS.
• Demonstrate and apply a thorough understanding of Third-Party Risk Management, with specific focus on cyber security, data protection, business resiliency, and other security risks associated with the use or technology (e.g.: cloud, API, IT infrastructure, external audits, BCP/DR, and operational security functions).
• Ability to assess and review third-party audit evidence from Strategic Partners such as: SOC reports, Penetration Testing reports, ITGC audit reports, PCI DSS SAQ/AOC/ROC, cyber insurance policies, etc.
<