Security Risk Officer

Merchants Bank has an opening for a Security Risk Officer. This position could work from any of our Merchants Bank branch locations in Minnesota or Wisconsin.

This role is responsibility for implementing, maintaining, and running the information and physical security program. This includes identifying, evaluating, mitigating, and reporting on legal and regulatory, IT Security (including cybersecurity), and physical security risk, while supporting and advancing business objectives in alignment with growth and financial performance expectations. Will proactively work with business units and managers to implement practices that meet agreed-on policies and standards for security. This position serves as collaborative liaison with Chief Risk Officer & IT on matters related to the budget for the information and physical security function.

Requires 5 years of experience in information security management including specific experience in the following areas: audit and exam response, incident response, reporting and information security program development. Also must have 5 years of general IT experience or 3 years of general IT experience and at least a 2-year degree in information security and 2 years of supervisory experience. A certification from an accredited association within the Information Security realm preferred. Must have excellent written and verbal communication abilities, be highly organized, a self-starter and willing to investigate.

Merchants Bank offers competitive wages and benefits for our full-time employees including health, dental, life, disability and vision insurance; flexible spending accounts, 401(k) and ESOP retirement plans; bonus plan; paid time off; tuition reimbursement; and a variety of voluntary supplemental insurance options.

Please click on Apply Now or apply in person at any Merchants Bank location. Questions can be emailed to hr@merchantsbank.com. Merchants Bank is an Equal Opportunity Employer of women, minorities, protected veterans and individuals with disabilities.


General Summary:
This is a working manager role with responsibility for implementing and running the information and physical security program for the Bank. The Security Risk Officer is responsible for identifying, evaluating, mitigating, and reporting on legal and regulatory, IT Security (including cybersecurity), and physical security risk, while supporting and advancing business objectives for the Company in alignment with growth and financial performance expectations.

Must possess a sound knowledge of business management and a working knowledge of cybersecurity and physical security technologies and systems covering the Company network and branch footprint as well as the broader digital ecosystem. This position is responsible for establishing and maintaining the information and physical security program to ensure that information assets and associated technology, applications, systems, infrastructure, processes, and physical locations are adequately protected in the environment in which we operate. This role will be the board approved Information Security Officer for the Company.

A key element of the role is working with the Chief Risk Officer and the Executive Leadership Team to determine acceptable levels of risk for the organization. Will proactively work with business units and managers to implement practices that meet agreed-on policies and standards for security. The Security Risk Officer should understand and articulate the impact of all security systems on the business and be able to communicate this to the board of directors and other senior stakeholders.

The Security Risk Officer must be knowledgeable about both internal and external business environments and ensure that systems are maintained in a fully functional and secure mode and are compliant with legal, regulatory, and contractual obligations. Serves as the process owner of the appropriate second-line assurance activities not only related to confidentiality, integrity, and availability, but also to the safety, privacy and recovery of information owned or processed by the business in compliance with regulatory requirements. This position understands that securing physical and information assets, associated technology, applications, systems and processes in the wider ecosystem in which the organization operates is as important as protecting information within the organization's perimeter.

Ultimately, is a business leader expected to maintain objectivity and a strong understanding that security and risk management are foundational but must be managed with balanced perspective about the ability of the business to deliver on its growth and performance goals and objectives.


Primary Responsibilities and Duties:
Security Governance and Awareness:
• Provide regular reporting on the current status of all security programs to enterpr