Chief Information Security Officer (CISO)

Credit Acceptance Corporation; Washington; Hybrid; USD 260,000 - 420,000; Full time

Job summary

Credit Acceptance is seeking a Vice President, Engineering - Security, Compliance and Trust (CISO) to drive enterprise information security strategy and regulatory compliance across platforms including cloud and AI environments.

You will lead a cross-functional team spanning security operations, security engineering, and governance, risk and compliance, reporting to executive leadership and the Board. Hybrid work options available from multiple U.S. locations.

Responsibilities

• Own the enterprise information security strategy, aligned to business goals and regulatory requirements.
• Lead security for cloud move (on-prem to AWS) with secure landing zones and modernization.
• Oversee vulnerability management with AI-assisted prioritization and accountable ownership.
• Manage identity and privileged access for people, services, and agents.
• Oversee data protection, privacy, and privacy-by-design across the product lifecycle, including AI data usage.
• Coordinate third-party cyber risk, audits, and penetration testing with rigorous controls.
• Lead threat detection and incident response, including AI-enabled attack defense and tabletop exercises.
• Define security for AI agents with least-privilege access and enforce audit trails.

Skills

Security leadership

Regulatory compliance

Cloud security

AI security

Governance & risk

Job description

At Credit Acceptance, we are building on the foundation of a successful business while investing in the future through technology, data, AI, and continuous improvement. As we continue to evolve, our Team Members play an active role in improving experiences, driving meaningful change, and shaping the future of our business. We foster an environment where people are empowered to contribute ideas, develop their careers, make an impact, and help lead our continued transformation.

Our Engineering teams are helping shape the future of Credit Acceptance through innovation. Team Members collaborate across the organization to solve complex challenges, build impactful solutions, challenge the status quo, and support informed business decisions. We value curiosity, continuous learning, and new ideas from people who are passionate about driving modernization and meaningful business impact.

Dealers and customers trust Credit Acceptance with their financial data. Regulators expect us to prove that trust is earned.

As the Vice President, Engineering - Security, Compliance and Trust (CISO), you will own how Credit Acceptance stays secure and compliant as we move to the cloud and put AI agents to work across the business. You will set the security strategy, lead the team that delivers it, and report on it to executive leadership and the Board. You are the company's designated CISO for regulatory purposes.

You report to the CTO and have direct access to the Audit Committee, including a private session at least once a year.

You will lead a team across security operations, security engineering (application, cloud, identity and AI security) and governance, risk and compliance. You will work closely with Engineering, Legal, Risk and Fraud so the secure path is also the fast path.

Agents are a new kind of actor in our environment. They have their own identities and make their own decisions. You will own the controls and evidence that let us adopt them quickly and keep the trust of our customers and regulators.

Hybrid from Southfield, MI; Bellevue, WA; or the San Francisco Bay Area.

Outcomes and Activities

• Own the enterprise information security strategy, tied to business goals, regulatory requirements and Engineering's AI and modernization plans.
• Own security for the move from on-premises data centers to AWS. Every workload lands in a secure, standard landing zone, and we modernize or retire legacy technology.
• Lead vulnerability and exposure operations. Critical findings are fixed in hours, with AI-assisted prioritization and a person accountable for every decision.
• Own identity and privileged access for people, services and agents.
• Own data protection and privacy: classification, handling standards and controls on where sensitive data can go. Review privacy engineering with product and engineering teams so privacy-by-design holds across the product lifecycle, including how AI systems use and keep data.
• Manage third-party and vendor cyber risk, from due diligence through ongoing monitoring, including security service providers, auditors and penetration testers. Any partner that builds or runs AI for us meets the same controls as our own teams.
• Lead threat detection and incident response, including playbooks for compromised or misbehaving agents and executive tabletop exercises. Defend against AI-enabled attacks such as deepfake impersonation and synthetic identity fraud, with our fraud and operations teams.
• Define how AI agents are secured, with Engineering's architecture and platform leaders. Each agent is a first-class identity with least-privilege access. Govern how agents call tools and data, including Model Context Protocol servers, and set policy for what an agent may decide and what stays with a person. Test AI systems and agents before release and continuously in production for prompt injection, tool misuse and data exfiltration. Every agent has an audit trail and can be suspended.
• Keep a living inventory of AI systems, agents and the AI features inside the tools we buy, including unsanctioned use. Set acceptable-use, data-handling and third-party AI standards aligned to NIST AI RMF and ISO/IEC 42001.
• Build security into how software is specified, generated, tested and deployed, including AI-assisted development. Automated gates replace manual reviews.
• Lead compliance with the obligations of a public consumer lender: GLBA, NYDFS Part 500, SOX IT general controls, PCI DSS, state privacy laws and SEC cybersecurity disclosure. That includes audit and examiner response, and systems that produce evidence automatically, down to a record an examiner can follow of what an agent saw and what it changed.
• Report to the Board: regular updates, the annual NYDFS Part 500 CISO report to the Board and the annual NYDFS certification, using a small set of metrics that drive decisions.
• Lead the Company's Information Security Compliance Committee, which meets at least quarterly with the Company's Executive Leadership Team.
• Build and