Director, Information Security

Position Summary The Director, Information Security, leads Technology Credit Union’s Information Security Program to protect member, employee, and organizational information. The role provides strategic, regulatory, and operational leadership; oversees security controls, technologies, and incident response; and advises executives and committees on cybersecurity risk and program effectiveness. The Director partners with technology and business leaders to securely enable emerging technologies, leads Information Security staff, and promotes a collaborative, risk-aware culture. Responsibilities Essential Duties Information Security Strategy and Leadership Leads the Information Security Program, including strategy, priorities, roadmaps, performance measures, and continuous improvement aligned with organizational objectives, regulatory expectations, and risk. Advises executives, committees, and the Board of Directors on cybersecurity risk, program performance, audit results, remediation, and key metrics. Manages, mentors, and develops Information Security staff while providing hands-on technical and operational leadership. Partners with technology and business leaders to securely enable strategic initiatives and emerging technologies. Evaluates security technologies and recommends solutions aligned with business needs and risk. Security Operations and Engineering Directs security monitoring, threat detection, investigation, containment, and incident response. Oversees security architecture and platforms across endpoint, identity, data, cloud, network, vulnerability management, and incident response. Evaluates attack vectors, vulnerabilities, threat intelligence, security events, and control gaps, and directs appropriate remediation or risk-treatment activities. AI Security Controls and Governance Leads security governance for AI systems and services. Defines security requirements for the acquisition, development, configuration, integration, and use of AI systems and third-party AI services. Oversees AI security assessments covering data exposure, unauthorized access, insecure integrations, misuse, third-party dependencies, and monitoring. Information Security Governance, Risk, and Compliance Develops, maintains, and enforces information security policies, standards, guidelines, procedures, risk-assessment methodologies, and governance processes. Ensures the Information Security Program addresses applicable financial-services regulatory and industry requirements, including National Credit Union Administration (NCUA), Federal Financial Institutions Examination Council (FFIEC), Gramm-Leach-Bliley Act (GLBA), and National Institute of Standards and Technology (NIST) frameworks. Directs information security risk assessments, control assessments, gap analyses, and remediation activities. Manages the Information Security Risk Register by documenting, prioritizing, assigning, treating, accepting, and escalating risks. Supports internal and external audits, regulatory examinations, and security assessments, and oversees remediation of related findings. Work Schedule Full-time; typically 40+ hours/week Flexible schedule within core business hours, Pacific Time, M-F Flexibility to occasionally work early or late hours, and extended weekend hours, typically with advance notice. Workplace Essentials Supports Tech CU’s Mission and Vision and consistently demonstrates Tech CU’s Values (Accelerate, Collaborate, Innovate, & Cultivate). Meets with manager on a regular basis to discuss goal alignment, performance metrics, and development plans. Complies with Tech CU policies and procedures. Upholds employee Code of Conduct and Business Ethics and ensures confidentiality of the workplace. Complies with requirements imposed by federal, state and local regulatory agencies. Adheres to internal control and security measures designed to ensure regulatory compliance and mitigate losses and errors. Qualifications Education: Bachelor’s degree in Information Security, Computer Science, Information Technology, Computer or Information Systems, emerging technologies, or a related technical or business discipline. A master’s degree in business, cybersecurity, information systems, or a related field is preferred. Experience: 6+ years' progressive information security or cybersecurity experience, including technical, hands-on responsibilities and security leadership roles.  Knowledge/Skills/Abilities: Advanced knowledge of information security program management, security architecture, defense in depth, cybersecurity operations, risk management, and data protection. Advanced knowledge of Security Information and Event Management (SIEM), Endpoint Detection and Response/Extended Detection and Response (EDR/XDR), identity and access security, vulnerability management, Data Loss Prevention (DLP), cloud security, Intrusion Detection System/Intrusion Prevention System (IDS/IPS), firewalls, network security, and incident response technologies. Knowledge of NCUA, FFIEC, GLBA, NIST, Payment Card Industry Data Security Standard (PCI-DSS), and related regulatory or industry frameworks. Knowledge of AI security risks, governance principles, control design, data-protection considerations, third-party AI risk, monitoring requirements, and secure AI lifecycle practices. Excellent written, verbal, presentation, and data-storytelling skills. Strong leadership, coaching, team-development, and motivational skills. Strong analytical, problem-solving, organizational, and decision-making skills. Ability to translate business, regulatory, and technical risks into practical and appropriately scaled security controls. Proven ability to influence stakeholders and build effective relationships across business, technology, risk, audit, compliance, and executive functions. Ability to manage multiple priorities, security roadmaps,