AVP of Information Security

Description Job Summary Overview The position is responsible for the information security and IT compliance capabilities across all Arizona Financial Credit Union technologies by evaluating and monitoring external and internal threat levels. Ensures that mitigating controls and systems are in place to protect the integrity of organizational assets and supports the overall security posture of the credit union. Responsible for the design, development, oversight, and coordination of information security strategy, policies, standards, architecture, and risk assessments in collaboration with business units throughout the organization. Essential Job Functions Information Security Leadership & Governance Accountable for the design, development, oversight, and coordination of information security strategy, policies, standards, architecture, and risk assessments across the organization. Monitors internal and external security threats and recommends appropriate mitigating controls. Maintains current knowledge of cybersecurity threats, trends, and emerging risks. Develops and delivers security awareness, education, and training programs for employees. Maintains required information security certifications and continuing professional development. Network Security & Security Operations Detects, prevents, investigates, and resolves security threats within the network environment. Administers and maintains security technologies including firewalls, VPNs, anti-virus solutions, encryption systems, intrusion detection, malware prevention, and related security platforms. Develops and maintains enterprise logging standards and Security Information and Event Management (SIEM) capabilities. Correlates security events and activities to identify, analyze, and respond to potential security incidents. Performs security testing activities including penetration testing and social engineering assessments. Recommends and implements applications used for network security monitoring, containment, and prevention. Information Security Compliance & Incident Response Develops controls, monitoring processes, and security rules to prevent unauthorized access and data breaches. Proactively monitors systems and devices to ensure encryption standards for data at rest and data in transit. Conducts periodic reviews and audits of security settings, data repositories, and system configurations to ensure compliance with applicable policies and procedures. Leads incident response activities and coordinates investigations related to information security incidents and data breaches. Assists in disaster recovery planning, testing, and evidence gathering related to cybersecurity incidents. Risk Management Partners with Information Technology and executive leadership to determine acceptable risk levels and ensure appropriate protection against potential threats. Develops and enhances the Information Security Program to improve the organization's overall security posture. Evaluates security risks and develops mitigation and response procedures. Provides monthly updates regarding information security posture, security initiatives, and roadmap progress to executive leadership and the Board of Directors. Performs other job-related duties as assigned. Requirements Position Required Qualifications Minimum Education and Experience Bachelor's degree in Information Systems, Computer Science, Cybersecurity, or a related field, or equivalent technical training. Ten (10) years of enterprise Information Technology experience and five (5) years of Information Security experience. Financial services experience preferred. Knowledge, Skills, and Abilities Thorough knowledge of information security principles, cybersecurity operations, and enterprise security architecture. Ability to evaluate security events and determine severity, impact, and appropriate response actions. Knowledge of security technologies including firewalls, VPNs, encryption, malware protection, intrusion detection, and SIEM platforms. Ability to analyze technical information and communicate effectively with executive leadership, Board members, and end users. Strong analytical, investigative, problem-solving, and risk assessment skills. Licenses, Training, and Certifications Required One or more of the following certifications or equivalent credentials: Certified Information Systems Security Professional (CISSP) Certified Information Security Manager (CISM) Certified Information Systems Auditor (CISA) GIAC Certified Incident Handler (GCIH) Similar industry-recognized information security certification Preferred Qualifications Financial services industry experience. Hybrid Work Environment and Physical Demands Regularly required to sit; use hands to finger keys accurately when using calculator machines or computer keyboards; reach with hands and arms. Occasionally lift and/or move up to 25 pounds. Specific vision abilities required by this job include close vision, color vision, depth perception, and the ability to adjust focus. The noise level in the work environment is usually moderate. Must be able to travel independently to department and branch locations. NOTE: The job description is intended to be generic in nature. It is not an exhaustive list of all duties and responsibilities. Requirements listed in the above qualifications and physical requirements are representative of the knowledge, skill, abilities, physical demands, or work environment required or encountered that must be met by an employee to successfully perform each duty and each function of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform these essential functions. Employees who work from home must have business operational internet to complete work tasks and communicate via video call or chat messaging systems in a dedicated workspace.