Title:VP, Information Security
Standard Hours:40
Primary Location:Home Office
Reports to:CIO
Position Summary
The Vice President of Information Security leads a modern, business-aligned security program across the organization’s Microsoft-based environment.
This role blends security leadership with cloud architecture and reliability principles, ensuring systems are not only protected, but also resilient, observable, and continuously improving.
The VP will work closely with internal teams, vendors and a managed service provider (MSP), maintaining accountability for outcomes while enabling efficient, scalable operations.
Core Responsibilities
Security Program Leadership
- Manage and maintain a risk-based, right-sized security program aligned to business priorities
- Manage security controls that balance protection, usability, and system performance
- Translate risk into clear, actionable decisions for leadership
Cloud Security, Architecture & Reliability
- Working with our vendors, ensure systems are architected with:
oStrong identity and access controls
oSecure configurations
oHigh availability and resilience
- Partner with MSP and IT to build secure, scalable, and fault-tolerant systems
- Promote infrastructure consistency and automation
Observability, Monitoring & Metrics
- Manage and enhance monitoring, logging, and alerting across all platforms
- Define and track key security and reliability metrics, such as:
oIncident detection and response times
oVulnerability remediation timelines
oSystem availability and performance
- Improve visibility into system behavior to support faster, more effective decision-making
Incident Response & Continuous Improvement
- Lead all aspects of incident response, including coordination with MSP, COO, and CIO
- Conduct root cause analysis and implement corrective actions
- Drive a culture of continuous improvement, reducing repeat incidents over time
- Ensure systems and processes evolve based on lessons learned
MSP Management & Operations
- Manage the MSP relationship, ensuring accountability and performance
•Oversee:
oSecurity monitoring
oAlert triage and response
oVulnerability management
oDesk top maintenance and issue resolution
- Define SLAs and ensure operational effectiveness
Risk, Compliance & Audit
- Working with internal and external resources, lead SSAE 18 / SOC audits, including preparation and remediation coordination.
- Maintain existing policies, standards, and documentation aligned to actual risk
•Create new policies as identified
Business Continuity & Resilience
- Co-Own business continuity and disaster recovery programs across the organization
- Participate in testing and improvement recommendations
Vendor & Partner Security
- Assess and monitor third-party security posture
- Integrate vendor risk into broader risk management practices
- Work with and manage other vendor partners to ensure best security practices and successful audits.
Security Culture & Awareness
- Promote a practical, accountable security culture
- Deliver targeted training and awareness programs to staff
- Stay current on threats and evolving best practices
Qualifications
- ~7–12 years in information security, cloud security, or related roles
- Experience with Azure and/or Microsoft 365 security and architecture
- Experience with monitoring, incident response, and cloud operations
- Familiarity with automation and modern infrastructure practices
- Experience working with MSPs or external service providers
- Exposure to SOC/SSAE 18 and regulated environments
Leadership Profile
- Hands-on and accountable, with both strategic and technical capability
- Focused on measurable outcomes and continuous improvement
- Pragmatic—balances security, reliability, and business needs
- Strong collaborator across technology, operations, and leadership
- Growth-oriented and eager to expand leadership scope
Work Conditions
•Sitting for extended periods of time
- Dexterity of hands and fingers to operate a computer keyboard, mouse, and other devices
- Physically able to participate in training sessions, presentations and meetings
- Some travel is required for the purpose of meeting with management, employees, and occasional credit union client meetings
AA EEO
Originally posted on Himalayas
