Director, Information Security

The Clearing House Payments Company L.L.C.; North Carolina; On-site; USD 180,000 - 240,000; Full time

Job summary

The Clearing House Payments Company L.L.C. seeks a Director of Information Security to provide strategic leadership, governance, and operational oversight of the organization’s information security programs.

The role drives development and execution of security strategies, policies, standards, and controls to protect enterprise systems, data, and critical business operations from evolving cyber threats. The ideal candidate will lead high-performing teams, manage complex security programs,

Qualifications

• Strategic leadership across information security domains.
• Experience managing risk in regulated environments.
• Strong governance, policy, and controls development.

Responsibilities

• Oversee SOC operations, threat monitoring, and incident response.
• Lead security metrics, risk reporting, and governance activities.
• Advise executive leadership on cybersecurity risks and mitigation strategies.
• Foster a security-first culture through awareness and collaboration across the enterprise.
• Evaluate emerging technologies to improve security capabilities.

Skills

Cybersecurity leadership

Risk management

Cloud security

IAM & PAM

Incident response

Job description

Position Summary

The Director, Information Security is responsible for providing strategic leadership, governance, and operational oversight for the organization's Information Security programs. This role leads the development and execution of security strategies, policies, standards, and controls designed to protect enterprise systems, applications, data, and critical business operations from evolving cyber threats. The role combines strategic leadership with strong cybersecurity expertise and operational execution.

The ideal candidate is a proven cybersecurity leader with experience building high-performing teams, managing complex security programs, influencing executive stakeholders, and operating within highly regulated environments.

About The Clearing House

The Clearing House Payments Company L.L.C. is a bank-owned industry utility that shapes the payments landscape and provides infrastructure for safe, reliable, and efficient payments. We see an economy where everyone is connected and a future where modern payments make life easier. The Clearing House operates four payment systems: a high-value wire-transfer system (the CHIPS® network), the country's first and largest instant payments system (the RTP® network), an automated clearinghouse network (the EPN® network), and a check image exchange network (the Image Exchange Network). TCH also operates a bank account number tokenization service, runs a payments association known as the TCH Payments Authority, and maintains the rules for private-sector check image exchange through its ECCHO® business line.

Key Responsibilities

Security Strategy & Leadership

• Develop, maintain, and execute the enterprise Information Security strategy, roadmap, and operating model.
• Align security initiatives with business objectives, risk management priorities, and regulatory requirements.
• Provide leadership across all Information Security functions, including security operations, threat management, vulnerability management, identity and access management, cloud security, application security, and security governance.
• Advise leadership on cybersecurity risks, emerging threats, and recommended mitigation strategies.
• Foster a security-first culture through awareness, education, and collaboration across the enterprise.
• Evaluate emerging technologies and cybersecurity trends to continuously improve organizational security capabilities.

Security Governance, Risk & Compliance

• Establish and maintain security policies, standards, procedures, and control frameworks.
• Ensure compliance with applicable regulatory, legal, and industry requirements.
• Lead security risk assessments and oversee remediation of identified risks and control gaps.
• Partner with Risk Management, Compliance, Legal, and Internal Audit teams to address audit findings and regulatory expectations.
• Provide oversight of security control effectiveness, risk reporting, and governance activities.
• Support regulatory examinations, independent assessments, and internal audits.

Security Operations & Threat Management

• Oversee Security Operations Center (SOC) activities and incident detection, response, and recovery capabilities.
• Ensure effective monitoring of security events, threats, vulnerabilities, and security incidents.
• Direct cyber incident response activities and executive communications during significant security events.
• Maintain threat intelligence, threat hunting, and security monitoring programs.
• Ensure operational security processes effectively reduce risk while maintaining business resiliency.
• Review security metrics, trends, and performance indicators to drive operational improvements.

Vulnerability & Cyber Risk Management

• Provide executive oversight of vulnerability management programs across infrastructure, cloud, applications, and third-party environments.
• Ensure timely identification, prioritization, remediation, and validation of security vulnerabilities.
• Establish risk-based methodologies for vulnerability prioritization and remediation.
• Monitor cybersecurity risk exposure and ensure business stakeholders understand associated risks.
• Review and approve remediation plans, exceptions, and compensating controls.

Identity & Access Management

• Ensure effective governance of user access, privileged access, authentication, and identity lifecycle management processes.
• Oversee implementation and operation of IAM, privileged access management (PAM), and identity governance (IGA) capabilities.
• Promote adoption of least privilege, multifactor authentication (MFA), and zero-trust security principles.
• Ensure access controls align with regulatory, audit, and security requirements.

Cloud & Application Security

• Provide strategic oversight for cloud security and secure application development practices.
• Ensure security requirements are integrated into technology architecture, cloud platforms, and software development lifecycles.
• Support DevSecOps adoption and secure-by-design engineering practices.
• Oversee security reviews of