SVP/Chief Information Security Officer

FourLeaf's ultimate goal is to provide the best-in-class member and employee experience, and it all begins with two things: hiring incredible people and giving them a great place to work.

The Senior Vice President (SVP)/Chief Information Security Officer (CISO) is responsible for establishing, executing, and continuously enhancing the Credit Union’s enterprise-wide information security and cybersecurity program. The SVP/CISO provides strategic leadership and governance over information security, cyber risk management, threat intelligence, incident response, vulnerability management, third-party technology risk, and regulatory compliance. Working in close partnership with Second Line of Defense (2LOD) Risk Management and Compliance functions, the CISO ensures the Credit Union maintains a strong security posture that protects member information, critical business operations, and technology assets while enabling business growth and innovation.

• Information Security Strategy & Governance
  • Develop, implement, and maintain the Credit Union’s enterprise information security strategy, framework, policies, and standards.
  • Implement and enforce enterprise security policies, procedures, and standards jointly developed with Second Line of Defense (2LOD) Risk Management and Compliance teams.
  • Ensure alignment of security practices with applicable regulatory requirements, industry standards, and Credit Union business objectives.
  • Provide regular reporting to executive management, Board committees, and regulators regarding cybersecurity risk, security posture, emerging threats, and remediation activities.
  • Establish and maintain information security governance processes, metrics, and key risk indicators.
• Cybersecurity Operations
  • Lead the Credit Union’s cybersecurity operations program, ensuring effective protection of information assets and infrastructure.
  • Oversee enterprise threat detection, threat intelligence, security monitoring, incident response, and vulnerability management activities.
  • Ensure timely response to security events and coordinate communication, recovery, and post-incident reviews.
  • Oversee penetration testing, vulnerability assessments, security monitoring tools, and remediation programs.
• Third-Party & Vendor Cyber Risk Management
  • Own and manage the cybersecurity vendor risk assessment process for third-party service providers, fintech partners, and technology vendors.
  • Evaluate and monitor the security posture of third-party technology relationships throughout the vendor lifecycle.
  • Collaborate with Procurement, Legal, Information Technology, and Risk Management to ensure appropriate cybersecurity due diligence and contractual protections.
  • Review vendor security controls, independent audit reports, penetration test results, and other security attestations.
  • Ensure ongoing monitoring and remediation of identified vendor security risks.
• Risk Management & Compliance
  • Partner with 2LOD teams to identify, assess, monitor, and mitigate information security and cyber risks.
  • Support enterprise risk management initiatives by providing subject matter expertise on cyber and technology risks.
  • Ensure compliance with NCUA guidance, FFIEC cybersecurity expectations, GLBA, state privacy requirements, and other applicable regulatory standards.
  • Track and report remediation of audit findings and risk issues.
• Leadership & Collaboration
  • Provide leadership and direction to information security personnel and external security partners.
  • Foster a culture of cybersecurity awareness and accountability across the organization.
  • Collaborate with Information Technology, Operations, Digital Banking, Enterprise Risk, Compliance, Internal Audit, and business line leaders to integrate security into business processes and technology initiatives.
  • Advise senior management on security implications of strategic initiatives, digital transformation efforts, and emerging technologies.
  • Oversee security awareness education and training programs for employees and stakeholders.

• Bachelor’s Degree required; Master’s degree preferred.
• 12+ years of progressive information security, cybersecurity, risk management, or technology leadership experience.
• 5+ years in a senior leadership role overseeing enterprise cybersecurity programs

• Demonstrated experience managing security operations, incident response, vulnerability management, governance, risk, and compliance programs.

• Experience overseeing third-party cyber risk and vendor security assessment programs

FourLeaf Federal Credit Union (FourLeaf) has been committed to the financial well-being of our members for over 80 years. Through our full range of competitive savings and loan products, you can trust us in every step of your financial journey. From applying for a credit card to closing on your mortgage to opening your child’s first savings account, FourLeaf is here to help you reach your financial goals.

We are proud to be an award-winning place to work! Some of our recent recognitions include Certified Great Place to Work 2024-2025, America’s Greatest Midsize Workplaces 2025, and Fortune’s Best Workplaces in Financial Services & Insurance 2024. 

As a credit union, our vision is to enrich the lives of our members, employees, and communities. Since 2002, we have been an integral community partner through our charitable giving and community development programs in New York and beyond.