AVP of Information Security

Job Summary Overview

The position is responsible for the information security and IT compliance capabilities across all Arizona Financial Credit Union technologies by evaluating and monitoring external and internal threat levels. Ensures that mitigating controls and systems are in place to protect the integrity of organizational assets and supports the overall security posture of the credit union. Responsible for the design, development, oversight, and coordination of information security strategy, policies, standards, architecture, and risk assessments in collaboration with business units throughout the organization.

Essential Job Functions

Information Security Leadership & Governance

• Accountable for the design, development, oversight, and coordination of information security strategy, policies, standards, architecture, and risk assessments across the organization.
• Monitors internal and external security threats and recommends appropriate mitigating controls.
• Maintains current knowledge of cybersecurity threats, trends, and emerging risks.
• Develops and delivers security awareness, education, and training programs for employees.
• Maintains required information security certifications and continuing professional development.

Network Security & Security Operations

• Detects, prevents, investigates, and resolves security threats within the network environment.
• Administers and maintains security technologies including firewalls, VPNs, anti-virus solutions, encryption systems, intrusion detection, malware prevention, and related security platforms.
• Develops and maintains enterprise logging standards and Security Information and Event Management (SIEM) capabilities.
• Correlates security events and activities to identify, analyze, and respond to potential security incidents.
• Performs security testing activities including penetration testing and social engineering assessments.
• Recommends and implements applications used for network security monitoring, containment, and prevention.

Information Security Compliance & Incident Response

• Develops controls, monitoring processes, and security rules to prevent unauthorized access and data breaches.
• Proactively monitors systems and devices to ensure encryption standards for data at rest and data in transit.
• Conducts periodic reviews and audits of security settings, data repositories, and system configurations to ensure compliance with applicable policies and procedures.
• Leads incident response activities and coordinates investigations related to information security incidents and data breaches.
• Assists in disaster recovery planning, testing, and evidence gathering related to cybersecurity incidents.

Risk Management

• Partners with Information Technology and executive leadership to determine acceptable risk levels and ensure appropriate protection against potential threats.
• Develops and enhances the Information Security Program to improve the organization's overall security posture.
• Evaluates security risks and develops mitigation and response procedures.
• Provides monthly updates regarding information security posture, security initiatives, and roadmap progress to executive leadership and the Board of Directors.

• Performs other job-related duties as assigned.