Chief Information Security Officer

Jobgether; Stati Uniti; Remoto; USD 180.000 - 300.000; Tempo pieno

Vantaggi offerti da questo lavoro

Competitive compensation package

Descrizione del lavoro

Partner Company seeks a Chief Information Security Officer based in the United States to lead security for a growing financial services group across brands. You will define strategy, build the program, and own key security decisions with hands-on execution and AI-driven monitoring.

In a global, remote-friendly setup, you will manage cloud security (AWS), IAM, incident response, vendor risk, and security communications with leadership while mentoring a small security team.

Competenze

• 10+ years in information security with 3+ years as CISO or head of security.
• Proven experience leading real-world security incidents including executive communication.
• Experience building or rebuilding a security program from early stage.
• Strong AI security knowledge and AI-driven security workflows.
• Hands-on AWS cloud security, IAM, SIEM, phishing defenses.

Mansioni

• Define and own security strategy, roadmap, and budget across brands.
• Lead incident response from detection to post-incident review.
• Oversee cloud security standards and IAM (SSO/MFA).
• Evaluate third-party vendors and security attestations.
• Lead phishing prevention and employee awareness training.
• Develop security policies and support SOC 2 / ISO 27001 readiness.
• Mentor security engineers and decide internal vs outsourced work.
• Build and maintain inventory of attack surface.
• Apply AI to alert triage, threat detection, and investigations.

Conoscenze

Security leadership

Incident response

Cloud security AWS

AI security

Vendor risk management

Strumenti

SIEM

Rapid7

Endpoint protection

Identity management

Descrizione del lavoro

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Chief Information Security Officer (CISO) based in the United States.

Take the lead in building and overseeing the information security function for a growing, diversified financial services group operating across multiple brands and business lines. As the first Chief Information Security Officer, you will define the security strategy, establish the program, and take direct ownership of critical security decisions and incident response. This is a hands-on leadership role combining traditional security responsibilities with the development of AI-driven systems for continuous monitoring, testing, and auditing. You will protect cloud infrastructure, platforms, customer data, identities, vendors, and brand reputation while helping teams adopt AI securely. Working closely with group leadership and a small, globally distributed engineering team, you will translate complex risks into clear priorities and actionable decisions. Approximately half of your time will be dedicated to hands-on security execution, with the remainder focused on leadership, strategy, and building scalable security capabilities.

Accountabilities

• Define and own the information security strategy, roadmap, and budget across all brands and business units within the group.

• Report security posture, emerging threats, key risks, and trends to group leadership through monthly briefings and actionable risk registers.

• Lead incident response from detection and triage through containment, eradication, recovery, and post-incident reviews.

• Coordinate incident response with legal counsel, forensic specialists, insurers, and regulators, maintaining up-to-date response procedures and conducting tabletop exercises.

• Establish and maintain cloud security standards, particularly across AWS environments, and oversee identity and access management, including SSO, MFA, least-privilege access, administrative redundancy, and short-lived credentials.

• Evaluate third-party vendors and data providers, review security audits and attestations, and define security requirements before vendors access company systems or data.

• Establish security standards for customer-facing platforms, including login protection and account-takeover prevention, in collaboration with engineering teams.

• Lead phishing prevention, email security, employee awareness training, and phishing simulations.

• Manage brand protection initiatives by identifying and coordinating the removal of fraudulent domains and accounts impersonating company brands or leadership.

• Develop and enforce practical security policies, support SOC 2 and ISO 27001 readiness with Legal and Compliance, and oversee public-facing security and trust communications.

• Lead, mentor, and develop security engineers while determining which capabilities should be built internally, outsourced, or automated.

• Provide security guidance for member scam-awareness communications in collaboration with Community, Support, and Marketing teams, with final wording subject to legal approval.

• Build and maintain a comprehensive inventory of the organization’s attack surface, including applications, cloud infrastructure, code repositories, SaaS platforms, integrations, data providers, access permissions, and logging coverage.

• Design and operate AI-driven security systems and agentic workflows for automated code and dependency reviews, configuration audits, access reviews, and vendor documentation assessments.

• Oversee the security technology stack, including SIEM, Rapid7, endpoint protection, email security, identity management, and device management, ensuring critical systems generate usable security logs.

• Apply AI to alert triage, threat detection, and investigation while maintaining appropriate human oversight for critical decisions.

• Establish secure AI development standards covering approved tools, permitted data access, code review, and release requirements for systems handling customer information.

• Secure AI agents and business automations through scoped credentials, restricted tool permissions, prompt-injection defenses, data-exposure controls, and production monitoring.

• Review high-risk AI agents before deployment, including internally developed security agents, and establish appropriate safeguards and operational controls.

Requirements

• 10+ years of experience in information security, including at least 3 years leading a security function as a CISO, Head of Security, or equivalent within an organization of 100+ employees.
• Demonstrated experience leading real-world security incidents, including executive communication and decision-making during active incidents.
• Proven ability to establish or rebuild a security program from an early stage, covering strategy, policies, technology, employee training, and incident response.
• Strong practical experience using AI agents and AI-powered tools in daily security operations, including detection development, code and configuration reviews, vendor documentation analysis, policy drafting, and automation.
• Ability to demonstrate AI-driven security workflows, agentic systems, or automation frameworks, with sound judgment about where human oversight remains essential.
• Deep and current understanding of AI-specific security risks, including prompt injection, excessive agent permissions, credential and data exposure through AI tools, and vulnerabilities in AI-generated code.
• Hands-on expertise in cloud security, preferably AWS, as well as identity and access management, SIEM, endpoint protection, and email security.
• Strong scripting and programming capabilities, with experience developing security tools, automation, and practical solutions beyond vendor interfaces.
• Experience in crypto, fintech, or another high-fraud industry, with strong knowledge of phishing, social engineering, and impersonation attacks.
• Excellent attention to detail and ability to assess technical documentation, contracts, vendor security requirements, and compliance evidence thoroughly.
• Strong communication skills, including the ability to brief executives in plain language, train non-technical employees, and create security policies that teams can understand and follow.
• Comfortable operating as a player-coach, dedicating approximately half of the role to hands-on execution while leading a small, fully remote team across multiple time zones.
• Experience preparing organizations for SOC 2 or ISO 27001 certification is a plus.
• Previous experience securing or evaluating AI agents and LLM-based tools in production is an advantage.
• Experience managing third-party risk programs, particularly involving financial data aggregators or similar providers, is desirable.
• Background in brand protection, fraud prevention, or domain and account takedown programs is beneficial.
• Experience developing customer-facing security features, such as account-takeover prevention, is an advantage.
• Familiarity with risk quantification methodologies such as FAIR and experience presenting security risks to a board are desirable.
• Relevant certifications such as CISSP, CISM, GCIH, or OSCP are considered a plus.

Benefits

• Competitive compensation package.