Chief Information Security Officer (CISO)

At Credit Acceptance, we are building on the foundation of a successful business while investing in the future through technology, data, AI, and continuous improvement. As we continue to evolve, our Team Members play an active role in improving experiences, driving meaningful change, and shaping the future of our business. We foster an environment where people are empowered to contribute ideas, develop their careers, make an impact, and help lead our continued transformation.

Our Engineering teams are helping shape the future of Credit Acceptance through innovation. Team Members collaborate across the organization to solve complex challenges, build impactful solutions, challenge the status quo, and support informed business decisions. We value curiosity, continuous learning, and new ideas from people who are passionate about driving modernization and meaningful business impact.

• Own the enterprise information security strategy, tied to business goals, regulatory requirements and Engineering's AI and modernization plans.

• Own security for the move from on-premises data centers to AWS. Every workload lands in a secure, standard landing zone, and we modernize or retire legacy technology.

• Lead vulnerability and exposure operations. Critical findings are fixed in hours, with AI-assisted prioritization and a person accountable for every decision.

• Own identity and privileged access for people, services and agents.

• Own data protection and privacy: classification, handling standards and controls on where sensitive data can go. Review privacy engineering with product and engineering teams so privacy-by-design holds across the product lifecycle, including how AI systems use and keep data.

• Manage third-party and vendor cyber risk, from due diligence through ongoing monitoring, including security service providers, auditors and penetration testers. Any partner that builds or runs AI for us meets the same controls as our own teams.

• Lead threat detection and incident response, including playbooks for compromised or misbehaving agents and executive tabletop exercises. Defend against AI-enabled attacks such as deepfake impersonation and synthetic identity fraud, with our fraud and operations teams.

• Define how AI agents are secured, with Engineering's architecture and platform leaders. Each agent is a first-class identity with least-privilege access. Govern how agents call tools and data, including Model Context Protocol servers, and set policy for what an agent may decide and what stays with a person. Test AI systems and agents before release and continuously in production for prompt injection, tool misuse and data exfiltration. Every agent has an audit trail and can be suspended.

• Keep a living inventory of AI systems, agents and the AI features inside the tools we buy, including unsanctioned use. Set acceptable-use, data-handling and third-party AI standards aligned to NIST AI RMF and ISO/IEC 42001.

• Build security into how software is specified, generated, tested and deployed, including AI-assisted development. Automated gates replace manual reviews.

• Lead compliance with the obligations of a public consumer lender: GLBA, NYDFS Part 500, SOX IT general controls, PCI DSS, state privacy laws and SEC cybersecurity disclosure. That includes audit and examiner response, and systems that produce evidence automatically, down to a record an examiner can follow of what an agent saw and what it changed.

• Report to the Board: regular updates, the annual NYDFS Part 500 CISO report to the Board and the annual NYDFS certification, using a small set of metrics that drive decisions.

• Lead the Company’s Information Security Compliance Committee, which meets at least quarterly with the Company’s Executive Leadership Team.  

• Build and develop the security team: hiring, developing people, building the skills to secure and use AI, and a security-aware culture across Engineering and the business.

Competencies

• Customer Empathy: Customer Empathy is the ability to understand the perspectives, pain points, and experiences of customers. It involves actively putting oneself in the customer’s shoes, comprehending their needs and challenges, and using that understanding to provide a better, more customer-centric experience.

• Engineering Excellence: Engineering Excellence is about bringing great craftsmanship and thought leadership to deliver an outstanding product that delights customers and solves for the business. This involves the pursuit and achievement of high standards, best practices, innovation, and superior solutions.

• One Team: A One Team mindset refers to a collaborative approach across the organization, where individuals work together seamlessly, without boundaries, as a single, cohesive team. Shared goals, open communication and mutual support create a sense of collective purpose. This enables teams to navigate challenges and pursue shared objectives more effectively.

• Owner’s Mindset: Owner’s Mindset involves adopting a set of behaviors that reflect a sense of responsibility, accountability, strategic thinking, and a proactive approach to managing your domain. As an owner, you understand the business and your domain(s) deeply and solve for the right outcome for the domain(s) and the business.

• Bachelor's degree (computer science or a related field preferred).

• 10+ years in information security, compliance or a related field.

• 10+ years leading an information security, compliance or risk team.

• Regulatory compliance experience in financial services, such as GLBA, NYDFS Part 500, SOX and PCI DSS.

• Experience leading business continuity and cyber incident response, including executive tabletop exercises and response to a significant incident.

• Strong familiarity with NIST CSF, ISO 27001/27002 and SOC 2.

• Strong knowledge of security architecture for cloud-native environments: identity and access management, encryption, network and endpoint controls and vulnerability management. Experience building security into CI/CD and software delivery.

• Practical experience securing AI-enabled systems or AI-assisted development in production, including identity and access, data protection and testing.

• Experience reporting security and risk to executive leadership and a Board.

Preferred

• Master's degree.

• Financial services, fintech or consumer lending experience.

• AWS and Databricks security at production scale, including securing a migration from on-premises infrastructure.

• Agentic AI in production: agent identity, governed tool access such as Model Context Protocol, runtime controls and agent-specific incident response.

• AI-assisted detection, triage and response in a security operations center, with human oversight.

• SEC cybersecurity disclosure experience as the security leader of a public company.

• Risk assessment for AI systems and third-party AI vendors.

• CISSP, CISM or an equivalent security certification.

Knowledge and Skills

• Architecture: Ability to design security architecture that is built in by default and enforced through automation, not manual review.

• AI and Agent Security: Working knowledge of how agents are attacked and how they fail (prompt injection, tool misuse, identity and privilege abuse, memory poisoning) and the controls that contain them, drawing on the OWASP Top 10 for Agentic Applications, NIST AI RMF and ISO/IEC 42001.

• Risk Judgment: Ability to weigh security risk against business value, decide what an agent or a team may do on its own, and explain the tradeoff and the evidence plainly. Holds the higher bar and says so.

• Executive Communication: Ability to turn technical and AI risk into clear decisions for executives and the Board.

• Leadership and Influence: Ability to build a strong team, challenge the status quo, and earn trust across Engineering, Legal, Compliance, Risk and the business without relying on authority.

To be successful in this role, Team Members need to be:

• Positive by maintaining resiliency and focusing on solutions
• Respectful by collaborating and actively listening
• Insightful by cultivating innovation, accumulating business and role specific knowledge, demonstrating self-awareness and making quality decisions
• Direct by effectively communicating and conveying courage
• Earnest by taking accountability, applying feedback and effectively planning and priority setting

• Remain compliant with our policies processes and legal guidelines
• All other duties as assigned
• Attendance as required by department