Job description
Title:VP, Information Security
Standard Hours:40
Primary Location:Home Office
Reports to:CIO
Position Summary
The Vice President of Information Security leads a modern, business-aligned security program across the organization’s Microsoft-based environment.
This role blends security leadership with cloud architecture and reliability principles, ensuring systems are not only protected, but also resilient, observable, and continuously improving.
The VP will work closely with internal teams, vendors and a managed service provider (MSP), maintaining accountability for outcomes while enabling efficient, scalable operations.
Core Responsibilities
Security Program Leadership
Manage and maintain a risk-based, right-sized security program aligned to business priorities
Manage security controls that balance protection, usability, and system performance
Translate risk into clear, actionable decisions for leadership
Cloud Security, Architecture & Reliability
Working with our vendors, ensure systems are architected with:
oStrong identity and access controls
oSecure configurations
oHigh availability and resilience
Partner with MSP and IT to build secure, scalable, and fault-tolerant systems
Promote infrastructure consistency and automation
Observability, Monitoring & Metrics
Manage and enhance monitoring, logging, and alerting across all platforms
Define and track key security and reliability metrics, such as:
oIncident detection and response times
oVulnerability remediation timelines
oSystem availability and performance
Improve visibility into system behavior to support faster, more effective decision-making
Incident Response & Continuous Improvement
Lead all aspects of incident response, including coordination with MSP, COO, and CIO
Conduct root cause analysis and implement corrective actions
Drive a culture of continuous improvement, reducing repeat incidents over time
Ensure systems and processes evolve based on lessons learned
MSP Management & Operations
Manage the MSP relationship, ensuring accountability and performance
•Oversee:
oSecurity monitoring
oAlert triage and response
oVulnerability management
oDesk top maintenance and issue resolution
Define SLAs and ensure operational effectiveness
Risk, Compliance & Audit
Working with internal and external resources, lead SSAE 18 / SOC audits, including preparation and remediation coordination.
Maintain existing policies, standards, and documentation aligned to actual risk
•Create new policies as identified
Business Continuity & Resilience
Co-Own business continuity and disaster recovery programs across the organization
Participate in testing and improvement recommendations
Vendor & Partner Security
Assess and monitor third-party security posture
Integrate vendor risk into broader risk management practices
Work with and manage other vendor partners to ensure best security practices and successful audits.
Security Culture & Awareness
Promote a practical, accountable security culture
Deliver targeted training and awareness programs to staff
Stay current on threats and evolving best practices
Qualifications
~7–12 years in information security, cloud security, or related roles
Experience with Azure and/or Microsoft 365 security and architecture
Experience with monitoring, incident response, and cloud operations
Familiarity with automation and modern infrastructure practices
Experience working with MSPs or external service providers
Exposure to SOC/SSAE 18 and regulated environments
Leadership Profile
Hands-on and accountable, with both strategic and technical capability
Focused on measurable outcomes and continuous improvement
Pragmatic—balances security, reliability, and business needs
Strong collaborator across technology, operations, and leadership
Growth-oriented and eager to expand leadership scope
Work Conditions
•Sitting for extended periods of time
Dexterity of hands and fingers to operate a computer keyboard, mouse, and other devices
Physically able to participate in training sessions, presentations and meetings
Some travel is required for the purpose of meeting with management, employees, and occasional credit union client meetings
AA EEO
Originally posted on Himalayas
Who can apply
Eligible countries: United States. Accepted UTC offsets: UTC-10, UTC-9, UTC-8, UTC-7, UTC-6, UTC-5, UTC+14. Review the full description for employer-specific work authorization, residency and schedule requirements.