Role Description
The Chief Information Security Officer (CISO) is accountable for establishing and executing client's enterprise-wide cybersecurity and information security strategy, and for setting the policies, standards, and guidance that govern how technology and cyber risk are managed across the organization. This senior role ensures the confidentiality, integrity, and availability of bank information assets while enabling business growth across their business lines.
As a member of the Senior Technology Leadership Team, the CISO serves as the principal authority on cybersecurity risk, security architecture, and regulatory security posture. The CISO also serves as a key partner in enterprise fraud coordination, ensuring alignment between cybersecurity defenses and fraud prevention strategies across client's digital and payment ecosystems. The CISO partners closely with Information Technology, Fraud, Enterprise Risk, Compliance, Legal, and Business leaders to ensure cyber and technology risks are consistently identified, assessed, and managed in alignment with enterprise risk frameworks, while embedding security into platforms, products, and operations.
The CISO balances strong security capabilities with pragmatic, risk-based guidance, enabling technology modernization and digital innovation in a highly regulated financial services environment.
Reporting Relationship
The CISO reports to the Chief Information Officer (CIO) and serves as a core member of the Senior Technology Leadership Team, with regular engagement with Enterprise Risk, Compliance, Legal, and the Board.
Team and Budget
The Chief Information Security Officer (CISO) is accountable for establishing and executing client's enterprise-wide cybersecurity and information security strategy, and for setting the policies, standards, and guidance that govern how technology and cyber risk are managed across the organization. This senior role ensures the confidentiality, integrity, and availability of bank information assets while enabling business growth across their business lines.
As a member of the Senior Technology Leadership Team, the CISO serves as the principal authority on cybersecurity risk, security architecture, and regulatory security posture. The CISO also serves as a key partner in enterprise fraud coordination, ensuring alignment between cybersecurity defenses and fraud prevention strategies across client's digital and payment ecosystems. The CISO partners closely with Information Technology, Fraud, Enterprise Risk, Compliance, Legal, and Business leaders to ensure cyber and technology risks are consistently identified, assessed, and managed in alignment with enterprise risk frameworks, while embedding security into platforms, products, and operations.
The CISO balances strong security capabilities with pragmatic, risk-based guidance, enabling technology modernization and digital innovation in a highly regulated financial services environment.
Reporting Relationship
The CISO reports to the Chief Information Officer (CIO) and serves as a core member of the Senior Technology Leadership Team, with regular engagement with Enterprise Risk, Compliance, Legal, and the Board.
Team and Budget
- 55 – 60 FTE and Managed Services Partner
- Annual Operating Budget: $20-25M
- Architect and execute enterprise cybersecurity and information security strategy, aligned to business objectives, regulatory obligations (eg. PCI Level 1), and the bank’s long-term strategy.
- Serve as a senior enterprise leader and trusted advisor to the CIO, executive leadership team, and Board, providing clear, risk-based perspectives on cybersecurity posture, trends, and material issues.
- Act as the bank's executive owner of cybersecurity risk, defining security policies, standards, and control expectations, and partnering closely with Enterprise Risk Management to ensure alignment with enterprise risk frameworks and risk appetite.
- Serve as an enterprise fraud partner and coordinator, collaborating with Fraud Prevention, Operations, and Business Unit leaders to ensure alignment between cybersecurity controls and fraud mitigation strategies, and to drive coordinated response to emerging fraud threats.
- Lead and mature the cybersecurity organization, encompassing security architecture and engineering, security operations and incident response, identity and access management, data protection, application and cloud security, and third-party security.
- Embed security-by-design into bank platforms, products, and services by partnering with application, infrastructure, data, and business leaders to enable secure innovation, cloud adoption, and modernization.
- Provide executive leadership during cyber incidents and crisis events, ensuring effective response, recovery, communication, and continuous improvement.
- Maintain accountability for regulatory and industry cybersecurity obligations, including FFIEC, GLBA, OCC, and PCI DSS, serving as the primary security liaison with regulators and ensuring successful examination and audit outcomes.
- Build, develop, and retain a high-performing security leadership team, with a strong focus on talent development, succession planning, and fostering a culture of accountability, partnership, and continuous improvement.
- Represent bank externally through industry and government collaboration, maintaining active engagement with peer institutions, information-sharing organizations, and appropriate public-sector partners to stay ahead of emerging threats
- Bachelor’s degree in Information Security, Computer Science, Engineering, or a related technical field; advanced degree preferred.
- 15+ years of progressive experience in information security, cybersecurity, or technology risk, with significant leadership experience at the enterprise level within Financial Services or similarly regulated industries.
- Demonstrated success leading and operating a comprehensive cybersecurity program in a banking, payments, or credit card environment, including PCI-regulated platforms and customer-facing digital channels.
- Proven experience partnering effectively with regulators, internal audit, risk management functions, and external stakeholders.
- Strong understanding of modern security architectures across cloud-native platforms, on-premise infrastructure, and legacy/mainframe environments.
- Track record of leading security transformation initiatives that enable business growth, technology modernization, and cloud adoption in a regulated environment.
- Relevant professional certifications (e.g., CISSP) strongly preferred.
- Enterprise Leadership & Executive Presence Acts as a credible enterprise leader with the ability to influence executive peers, brief the Board, and represent the bank confidently with regulators, card networks, and external stakeholders.
- Risk-Based Judgment & Business Alignment Applies a pragmatic, business-oriented approach to cybersecurity risk, balancing protection, resilience, and growth while enabling innovation.
- Financial Services & Payments Security Expertise Brings experience securing banking and credit card platforms, including PCI-regulated environments, cloudnative architectures, and internally developed systems.
- Crisis Leadership Leads cybersecurity incident response and crisis management with clarity and confidence, ensuring organizational readiness, effective recovery, and continuous improvement.
- Operational Resilience Partners across the enterprise to coordinate fraud and cyber threat response, bridging technical security controls with fraud detection and prevention capabilities.
- Builds Culture & Talent Builds strong, diverse teams; develops future leaders; and fosters a culture of partnership, accountability, and shared ownership for cybersecurity outcomes across the bank.
- Board of Directors / Board Risk or Audit Committee
- Executive Leadership Team
- Enterprise Risk Management, Compliance, Internal Audit
- IT, Engineering, Digital, and Business Unit Leaders
- Regulators, Examiners, and External Partners