AVP, Information Security

Amerisure creates exceptional value for its partners, policyholders, and employees. As a property and casualty insurance company, Amerisure’s promise to our partner agencies and policyholders begins with a comprehensive line of insurance products designed to protect businesses, as well as the health and safety of every employee. With an A.M. Best “A” (Excellent) rating, Amerisure serves mid-sized commercial enterprises focused in construction, manufacturing and healthcare. Ranked as one of the top 100 Property & Casualty companies in the United States, we proudly manage nearly $1 Billion of Direct Written Premium and maintain $1.21 billion in surplus.

Amerisure is currently recruiting for an AVP, Information Security that can do a 3-day hybrid approach onsite in our Farmington Hills office. The ideal candidate will also possess the following skill set. 

Summary Statement

The AVP of Information Security leads the company’s cybersecurity strategy and operations, including the strategy for managing cyber risks, and the protection of information assets through comprehensive awareness, compliance, security operations, risk management, and incident response initiatives. This role delivers practical, risk-based solutions by continuously validating technical controls via vulnerability assessments, independent evaluations, and penetration testing. Continuously assesses the external threat environment to drive enhancements to Amerisure's security posture, supporting business objectives, and maintaining regulatory compliance.

Essential Tasks/Major Duties

• Lead and direct staff in area of responsibility with an emphasis on talent management and succession planning in accordance with the company’s strategic direction.
• Serves as advisor to Chief Information Officer (CIO) and executive leadership team on cybersecurity risks, and posture. Provides regular reporting on the status of the cybersecurity program to senior business leaders, the board of directors, and regulators.
• Designs and oversees the development and implementation of enterprise security policy, standards, guidelines, and procedures to maintain security posture, ensuring ongoing maintenance of security practices and consistency with best practices and regulatory frameworks (NYDFS, MI DIFS, NIST, NAIC).
• Oversee the identification, assessment, and mitigation of cybersecurity risks across the organization, including third-party risk management.
• Manage the cybersecurity governance program and regularly report risk metrics and status updates to executive leadership and relevant committees.
• Conduct enterprise risk assessments and ensure findings are tracked to resolution, with ownership assigned and progress monitored.
• Creates training programs of security policies, best practices and procedures to ensure that all staff has an understanding of how they contribute to the overarching security of the organization.
• Collaborates with senior Business and IT leadership to define and evolve information security standards and controls, and mentors Security staff and associated management teams on the security process.
• Collaborates with the Enterprise Risk Management (ERM) team and Business Continuity Program office to integrate cybersecurity measures into business resilience, including risk management and continuity planning.
• Oversees a network of security staff and security vendors to safeguard the company's assets, intellectual property and computer systems.
• Direct the security operations center (SOC), overseeing threat detection, threat hunting, incident response, digital forensics, and vulnerability management.
• Maintains relationships with local, state and federal law enforcement and other related government agencies.
• Leads cross-functional cyber incident response program and investigations, including tabletop and other preparedness exercises.
• Works with outside consultants as appropriate for independent security audits.
• Champion the adoption of cutting-edge security technologies and proactive defense measures to ensure operational excellence and resilience against evolving cyber threats.

Knowledge, Skills & Abilities

• Degree in Computer Science or related Field or the equivalent combination of education and/or relevant experience. Master’s degree in Cybersecurity, Information Assurance, Business Administration (MBA), or a related discipline, preferred.
• Minimum of 10 years of IT experience, including at least 5 years in management roles with responsibilities in budgeting and forecasting.
• Minimum of 8 years of experience in Information Security, with expertise in analysis, design, and integration of security measures into applications, systems, and netw