Information Security Governance Officer
Serves as the designated Information Security Officer for Park Community Credit Union, independently overseeing cybersecurity risk: leading the InfoSec program, maintaining policies and risk assessments, overseeing vendor security and incident response governance, and reporting to management and governance committees. Core focus is NCUA/FFIEC/GLBA regulatory compliance and security oversight rathe
- Compensation
- Not disclosed
- Location
- Louisville, KY
- Work setup
- Not specified
- Seniority
- C level
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- 5-7 years of progressively responsible experience in information security, cybersecurity, IT risk management, or security governance
- Bachelor's degree, or industry certifications (CISM, CISSP, or CISA) in lieu of a degree
- Knowledge of cybersecurity technologies and controls (anti-malware, MDR/XDR, firewalls) and ability to assess risk and control effectiveness
- Understanding of network security principles, IT infrastructure, and cybersecurity frameworks
- Knowledge of NCUA, FFIEC, GLBA, and other regulatory expectations
- Interpersonal skills requiring confidentiality, diplomacy, and tact
- Ability to work and travel independently
- Proficiency with office equipment, word processing, spreadsheets, email, and PC operating systems
Full description
Role:
By emphasizing ONE Park, ONE mission, ONE team, the Information Security Governance Officer serves as Park's designated Information Security Officer, reporting to the VP of Risk and providing independent oversight of information security and cybersecurity risks across the organization. This position leads the Credit Union's Information Security Program by establishing security requirements, assessing risks, evaluating controls, monitoring compliance, tracking remediation, and escalating material concerns. The role also oversees third-party information security risks, incident response governance, and regulatory compliance while collaborating with Information Technology. The officer regularly reports information security risks, trends, and program effectiveness to management and relevant governance committees.
Essential Functions & Responsibilities:
- Lead the Credit Union's Information Security Program, including identifying, assessing, monitoring, and reporting cybersecurity and technology-related risks. Maintain security risk assessments, establish security requirements, evaluate mitigating controls, and provide independent challenge of Information Technology and other departments. Ensure material risks, exceptions, and deficiencies are documented, escalated, and aligned with the Credit Union's risk appetite.
- Develop, maintain, and oversee information security policies, standards, and requirements. Monitor emerging cybersecurity threats, industry practices, and applicable NCUA, FFIEC, GLBA, and other regulatory expectations. Assess organizational compliance, recommend program enhancements, and regularly report information security risks, trends, and material concerns to management and relevant governance committees.
- Oversee information security risks associated with third-party service providers and technology vendors. Collaborate with Vendor Management and Information Technology to establish security due diligence requirements, evaluate vendor security assessments and SOC reports, and review contractual security protections. Monitor identified vendor risks, track outstanding deficiencies, and escalate material concerns through established governance channels.
- Oversee the governance of the Credit Union's Incident Response Program, including incident response procedures, escalation protocols, regulatory notification considerations, and reporting requirements. Coordinate with Information Technology and other stakeholders to evaluate significant security incidents, monitor corrective actions, and oversee periodic incident response exercises. Provide governance oversight of information security considerations within business continuity and disaster recovery planning.
- Maintain information security governance documentation, including risk assessments, policies, exceptions, incident records, and remediation tracking. Coordinate information security matters for internal audits, external audits, and regulatory examinations, including responding to findings, monitoring corrective action plans, and reporting material deficiencies.