CISO, AI & Cloud Security Leader – Hybrid

Credit Acceptance; Southfield (MI); Hybrid; USD 300.000 - 400.000; Vollzeit

Benefits dieser Stelle

401(K) match

Parental leave

Tuition reimbursement

Zusammenfassung

Credit Acceptance is seeking a strategic security leader to serve as VP, Engineering - Security, Compliance and Trust (CISO). You will own security strategy, oversee a team across security operations, engineering, governance, risk and compliance, and report to the CTO and Board.

Hybrid work from Southfield, MI or other locations; lead cloud migration, AI safety, regulatory compliance, and data protection to sustain trust with customers and regulators.

Qualifikationen

• Bachelor's degree (computer science or a related field preferred).
• 10+ years in information security, compliance or a related field.
• 10+ years leading an information security, compliance or risk team.
• Regulatory compliance experience in financial services, such as GLBA, NYDFS Part 500, SOX and PCI DSS.
• Experience leading business continuity and cyber incident response, including executive tabletop exercises and response to a significant incident.
• Strong familiarity with NIST CSF, ISO 27001/27002 and SOC 2.
• Strong knowledge of security architecture for cloud-native environments: identity and access management, encryption, network and endpoint controls and vulnerability management. Experience building security into CI/CD and software delivery.
• Practical experience securing AI-enabled systems or AI-assisted development in production, including identity and access, data protection and testing.
• Experience reporting security and risk to executive leadership and a Board.

Aufgaben

• Own the enterprise information security strategy, tied to business goals, regulatory requirements and Engineering's AI and modernization plans.
• Own security for the move from on-premises data centers to AWS. Every workload lands in a secure, standard landing zone, and we modernize or retire legacy technology.
• Lead vulnerability and exposure operations. Critical findings are fixed in hours, with AI-assisted prioritization and a person accountable for every decision.
• Own identity and privileged access for people, services and agents.
• Own data protection and privacy: classification, handling standards and controls on where sensitive data can go. Review privacy engineering with product and engineering teams so privacy-by-design holds across the product lifecycle, including how AI systems use and keep data.
• Manage third-party and vendor cyber risk, from due diligence through ongoing monitoring, including security service providers, auditors and penetration testers. Any partner that builds or runs AI for us meets the same controls as our own teams.
• Lead threat detection and incident response, including playbooks for compromised or misbehaving agents and executive tabletop exercises. Defend against AI-enabled attacks such as deepfake impersonation and synthetic identity fraud, with our fraud and operations teams.
• Define how AI agents are secured, with Engineering's architecture and platform leaders. Each agent is a first-class identity with least-privilege access. Govern how agents call tools and data, including Model Context Protocol servers, and set policy for what an agent may decide and what stays with a person. Test AI systems and agents before release and continuously in production for prompt injection, tool misuse and data exfiltration. Every agent has an audit trail and can be suspended.
• Keep a living inventory of AI systems, agents and the AI features inside the tools we buy, including unsanctioned use. Set acceptable-use, data-handling and third-party AI standards aligned to NIST AI RMF and ISO/IEC 42001.
• Build security into how software is specified, generated, tested and deployed, including AI-assisted development. Automated gates replace manual reviews.
• Lead compliance with the obligations of a public consumer lender: GLBA, NYDFS Part 500, SOX IT general controls, PCI DSS, state privacy laws and SEC cybersecurity disclosure. That includes audit and examiner response, and systems that produce evidence automatically, down to a record an examiner can follow of what an agent saw and what it changed.
• Report to the Board: regular updates, the annual NYDFS Part 500 CISO report to the Board and the annual NYDFS certification, using a small set of metrics that drive decisions.
• Lead the Company's Information Security Compliance Committee, which meets at least quarterly with the Company's Executive Leadership Team.
• Build and develop the security team: hiring, developing people, building the skills to secure and use AI, and a security-aware culture across Engineering and the business.

Jobbeschreibung

Credit Acceptance is seeking a strategic security leader to serve as VP, Engineering - Security, Compliance and Trust (CISO). You will own security strategy, oversee a team across security operations, engineering, governance, risk and compliance, and report to the CTO and Board.

Hybrid work from Southfield, MI or other locations; lead cloud migration, AI safety, regulatory compliance, and data protection to sustain trust with customers and regulators.