Director, Information Security

The Director, Information Security, leads Technology Credit Union’s Information Security Program to protect member, employee, and organizational information. The role provides strategic, regulatory, and operational leadership; oversees security controls, technologies, and incident response; and advises executives and committees on cybersecurity risk and program effectiveness. The Director partners with technology and business leaders to securely enable emerging technologies, leads Information Security staff, and promotes a collaborative, risk-aware culture.

Essential Duties

Information Security Strategy and Leadership

• Leads the Information Security Program, including strategy, priorities, roadmaps, performance measures, and continuous improvement aligned with organizational objectives, regulatory expectations, and risk.
• Advises executives, committees, and the Board of Directors on cybersecurity risk, program performance, audit results, remediation, and key metrics.
• Manages, mentors, and develops Information Security staff while providing hands-on technical and operational leadership.
• Partners with technology and business leaders to securely enable strategic initiatives and emerging technologies.
• Evaluates security technologies and recommends solutions aligned with business needs and risk.

Security Operations and Engineering

• Directs security monitoring, threat detection, investigation, containment, and incident response.
• Oversees security architecture and platforms across endpoint, identity, data, cloud, network, vulnerability management, and incident response.
• Evaluates attack vectors, vulnerabilities, threat intelligence, security events, and control gaps, and directs appropriate remediation or risk-treatment activities.

AI Security Controls and Governance

• Leads security governance for AI systems and services.
• Defines security requirements for the acquisition, development, configuration, integration, and use of AI systems and third-party AI services.
• Oversees AI security assessments covering data exposure, unauthorized access, insecure integrations, misuse, third-party dependencies, and monitoring.

Information Security Governance, Risk, and Compliance

• Develops, maintains, and enforces information security policies, standards, guidelines, procedures, risk-assessment methodologies, and governance processes.
• Ensures the Information Security Program addresses applicable financial-services regulatory and industry requirements, including National Credit Union Administration (NCUA), Federal Financial Institutions Examination Council (FFIEC), Gramm-Leach-Bliley Act (GLBA), and National Institute of Standards and Technology (NIST) frameworks.
• Directs information security risk assessments, control assessments, gap analyses, and remediation activities.
• Manages the Information Security Risk Register by documenting, prioritizing, assigning, treating, accepting, and escalating risks.
• Supports internal and external audits, regulatory examinations, and security assessments, and oversees remediation of related findings.

Work Schedule

• Full-time; typically 40+ hours/week
• Flexible schedule within core business hours, Pacific Time, M-F
• Flexibility to occasionally work early or late hours, and extended weekend hours, typically with advance notice.

Workplace Essentials

• Supports Tech CU’s Mission and Vision and consistently demonstrates Tech CU’s Values (Accelerate, Collaborate, Innovate, & Cultivate).
• Meets with manager on a regular basis to discuss goal alignment, performance metrics, and development plans.
• Complies with Tech CU policies and procedures.
• Upholds employee Code of Conduct and Business Ethics and ensures confidentiality of the workplace.
• Complies with requirements imposed by federal, state and local regulatory agencies.
• Adheres to internal control and security measures designed to ensure regulatory compliance and mitigate losses and errors.

Education: Bachelor’s degree in Information Security, Computer Science, Information Technology, Computer or Information Systems, emerging technologies, or a related technical or business discipline. A master’s degree in business, cybersecurity, information systems, or a related field is preferred.

Experience: 6+ years' progressive information security or cybersecurity experience, including technical, hands-on responsibilities and security leadership roles. 

Knowledge/Skills/Abilities:

• Advanced knowledge of information security program management, security architecture, defense in depth, cybersecurity operations, risk management, and data protection.
• Advanced knowledge of Security Information and Event Management (SIEM), Endpoint Detection and Response/Extended Detection and Response (EDR/XDR), identity and access security, vulnerability management, Data Loss Prevention (DLP), cloud security, Intrusion Detection System/Intrusion Prevention System (IDS/IPS), firewalls, network security, and incident response technologies.
• Knowledge of NCUA, FFIEC, GLBA, NIST, Payment Card Industry Data Security Standard (PCI-DSS), and related regulatory or industry frameworks.
• Knowledge of AI security risks, governance principles, control design, data-protection considerations, third-party AI risk, monitoring requirements, and secure AI lifecycle practices.
• Excellent written, verbal, presentation, and data-storytelling skills.
• Strong leadership, coaching, team-development, and motivational skills.
• Strong analytical, problem-solving, organizational, and decision-making skills.
• Ability to translate business, regulatory, and technical risks into practical and appropriately scaled security controls.
• Proven ability to influence stakeholders and build effective relationships across business, technology, risk, audit, compliance, and executive functions.
• Ability to manage multiple priorities, security roadmaps, projects, incidents, and remediation activities concurrently.
• Ability to communicate complex security risks clearly and concisely to executives, directors, regulators, auditors, technical teams, and business stakeholders.
• Demonstrated initiative, adaptability, accountability, attention to detail, and ability to work effectively in a lean, collaborative environment. 

Licensing/Certifications: One or more relevant professional certifications are preferred, such as:

• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified in Risk and Information Systems Control (CRISC)
• Global Information Assurance Certification (GIAC)
• Other equivalent information security, risk, cloud security, or AI governance certification

Travel: May be required to travel occasionally to Tech CU locations, typically with advance notice. May be required to occasionally attend offsite training, meetings or events, including some overnight travel, typically with advance notice.

Typical Working Conditions: Office environment with interaction with a variety of internal and external parties. May work remotely as determined by business need and individual performance.

Equipment Used: Routinely uses standard office equipment, including computer, phone and other devices.

Physical Requirements: This position requires:

• Speaking and listening to interact with internal and external parties in person or via phone.
• Reading a computer screen and performing keyboarding tasks for up to 70% of the day.
• Sitting at desk and/or conference table for extended periods of time.
• Mobility to attend meetings.

EQUAL EMPLOYMENT OPPORTUNITY

Technology Credit Union is an Equal Opportunity Employer. All qualified employees and applicants receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetic information, age, disability, veteran status or any other legally protected basis. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, and transfer, leaves of absence, compensation and training.

• Position Grade: 109
• Salary Range: minimum-$154,000, midpoint-$188,000, maximum-$222,000
• Work Location: The salary range listed is based on working in San Jose, CA. If you work remotely, your salary will be adjusted based on your geographic location.
• Typical Starting Pay: Most new hires start between the minimum and midpoint of the range (adjusted for work location if applicable), based on experience and qualifications.
• Bonus Potential: Target 20% of base salary based on company and individual performance

Tech CU is a pay-for-performance organization. We benchmark base pay to the 50th percentile of our market and offer incentive-based compensation tied to individual and company goals.

Tech CU offers a comprehensive benefits package, including:

• Health Coverage: Medical, dental, and vision plans
• Income Protection: Life and disability insurance
• Retirement: 401(k) plan with company match
• Paid Holidays: 12 days annually
• Paid Time Off (PTO):
• Accrues at 7.08 hours per bi-weekly paycheck (approximately 23 days per year)
• Increases with length of service
• Voluntary Time Off (VTO):
• 8 hours annually for full-time employees to support charitable organizations
• Additional Benefits:
• Flexible Spending Accounts
• Employee-paid voluntary benefits
• Leaves of absence in compliance with state and federal regulations