Cybersecurity Governance, Risk and Compliance Manager

SF Fire Credit Union

San Francisco (CA)

On-site

USD 145,000 - 217,000

Full time

3 days ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

401(k) and Employer Match

Health, Vision, Dental and Life

Annual Incentive/Bonus Program

Tuition Reimbursement

Paid Holidays + PTO

Professional development

Wellness Program

Job summary

SF Fire Credit Union is seeking a full-time Cybersecurity Governance, Risk and Compliance Manager to oversee cybersecurity risk independently of CIO/IT management. You will review practices, challenge remediation timelines, and ensure critical issues reach the right decision-makers while maintaining strong governance and compliance across IT, Legal, and business functions.

The role requires deep cybersecurity expertise, sound judgment, and the ability to communicate clearly across leadership

Qualifications

Bachelor’s degree in Information Security, Computer Science or related field.
7+ years of progressive cybersecurity experience or related IT/Compliance/Audit.
Certifications such as CISSP, CCSP, CISM, GIAC, CISA, CRISC, PCI-related.

Responsibilities

Independently review IT cybersecurity practices, policies, configurations and control effectiveness.
Assess IT response to vulnerabilities and threat intel with regard to risk exposure.
Recommend improvements to IT controls, resources, and remediation plans.
Escalate material cybersecurity risks with documented justification.

Skills

Cybersecurity strategy

Governance risk compliance

Independent assessment

Education

Bachelor’s degree in Information Security or related field

Job description

Where It Began…

In 1951 SF Fire Credit Union first opened its doors from a modest 10′ × 15′ office space in 17 Engine. It was from those humble beginnings—where everyone pitched in to help one another in their community—that the organization forged its way of business forever.

Today, the San Francisco-based credit union has grown to $1.7B in assets and a membership that extends from the regional firefighters we trace our roots back to throughout our many neighbors in San Francisco, San Mateo and Marin Counties. Our members benefit from the ideas and principles that have shaped us: Shared trust, continuous innovation of products and services, competitive rates, and excellent member service. These qualities foster a true sense of member-ownership and strengthen the credit union’s bond with the people for whom this credit union was created.

What We Stand For…

There are a few things we look for in those we hire at SF Fire Credit Union, regardless of role or team.

First, do they align with our values?

Be Personal: Walk the Member / Employee Path
Be a Leader: Empower, Collaborate, Own
Be Outside the Box: Innovate, Educate, Engage
Be Real: Integrity and Transparency Matter
Be the Connection: Serve our Community

Second, will they thrive in a culture like ours, where we default to trust, embrace feedback, and desire to innovate?

Finally, do they share our vision to help empower members to accomplish their dreams and build lasting financial security in whatever way is most relevant to their role?

What It Feels Like…

Most days it feels more like going to work with a big family.

Whether it’s a pot luck lunch, baking birthday cakes for colleagues in the kitchen, or after-hours get togethers, we’re here to do a great job and have a good time while doing it! We value a good sense of humor, are motivated by a higher purpose, and always bring an “in-this-together” attitude. While we’re driven to do great work, we also value real work/life balance.

Is This the Career for You?

SF Fire Credit Union is seeking a full-time Cybersecurity Governance, Risk and Compliance Manager to provide independent oversight of the Credit Union’s cybersecurity risk. Operating independently of the CIO and IT management reporting lines, this role reviews IT cybersecurity practices and control effectiveness, challenges decisions to defer remediation or accept risk, and ensures material cybersecurity issues reach the appropriate decision makers.

Success in this position requires deep cybersecurity expertise, sound judgment, and the ability to communicate clearly and challenge constructively across IT, Information Security, Compliance, Legal, and business leadership.

What You Get To Do

Independent Risk Assessment and Challenge

Independently review IT cybersecurity practices, policies, configurations, procedures, and control effectiveness
Assess whether IT’s response to emerging vulnerabilities, security advisories, and threat intelligence is timely and proportionate to the institution’s risk exposure
Recommend improvements to IT controls, processes, resource allocation, and remediation plans
Challenge decisions to defer remediation or accept cybersecurity risks and require documented justification and appropriate risk acceptance

Cross-functional Coordination and Communication

Establish expectations for sharing material cybersecurity information among IT, Information Security, Marketing, Compliance, Legal, Business Leadership, and affected functions
Verify that relevant stakeholders are notified when a threat may affect the organization, its website, customer-facing systems, confidential information, or business operations
Ensure that threat assessments and recommended actions are communicated to the appropriate decision makers, with clear ownership and deadlines

Oversight, Validation, and Escalation

Independently monitor remediation of identified cybersecurity weaknesses and verify copletion of material corrective actions
Maintain a risk-based register of significant cybersecurity issues, remediation commitments, overdue actions, and accepted risks
Escalate material or overdue issues to the CRO and, when appropriate, the CEO or the appropriate board committee provide periodic reporting on cybersecurity risk exposure, control effectiveness, incident response, phishing trends, and outstanding remediation

Authority and Organizational Positioning

The role should operate independently of the CIO and IT management reporting lines. It should have sufficient access to relevant systems documentation, policies, incident records, assessment results, and personnel to perform its oversight responsibilities.

The role should have the authority to request corrective action plans, challenge proposed remediation timelines, recommend additional safeguards, and elevate unresolved concerns without IT management approval.

Where a material risk requires immediate protective action, the role should be empowered to recommend urgent containment measures and invoke a defined escalation process. Any authority to direct or suspend technology operations should be explicitly established in the organization’s governance framework, including clear decision rights, emergency procedures, and coordination requirements with the CIO and CRO.

The role should be appropriately resourced for the institution’s size and risk profile. The initial structure may be a dedicated Cybersecurity Governance, Risk and Compliance Manager or an appropriately qualified individual with a clearly defined mandate, provided the necessary independence, expertise, and authority are maintained.

What We Look For In You

Desired Qualifications:

Bachelor’s degree in Information Security, Computer Science or related field, Advanced degree preferred
Required 7+ years of progressive cybersecurity experience or related experience in IT, Compliance, or Audit
CISSP, CCSP, CISM, GIAC, CISA, CRISC, or PCI-related certifications, including PCIP, ISA, or QSA

This job description describes the general nature and level of work expected of the position. Responsibilities may evolve as organizational needs and strategic priorities change.

Salary

This compensation range takes into account the wide range of factors considered in making compensation decisions, including but not limited to skill sets, experience and training, licensure and certifications, and other business and organizational needs. At SFFCU, it is not typical for an individual to be hired at or near the top of the range for their role, and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range for the San Francisco market is an annual base salary of $144,800 to $217,000.

OUR BENEFITS