Information Security Officer

HawaiiUSA FCU; Honolulu (HI); On-site; USD 111,000 - 150,000; Full time

Benefits offered by this job

Health insurance

401(k) plan with company contribution

Tuition reimbursement

Volunteer time off

Credit union membership

Paid training

Job summary

HawaiiUSA FCU in Honolulu, HI, seeks an Information Security Officer to own and evolve the security program and governance. You will drive risk assessments, incident response, and third-party risk, coordinating with an outsourced CISO and Board reporting.

The role requires leadership in building an internal security function within an enterprise risk framework, with opportunities to shape policy and security controls across cloud, on-premises, and vendor relationships.

Qualifications

• 7+ years in information security or related field, with finance experience preferred.

Responsibilities

• Own and maintain the Information Security Program (ISP) with governance committee input.
• Conduct annual risk assessments of information systems and vendors.
• Oversee incident response plan including 72-hour notification rule.
• Lead vulnerability management, testing, and patch programs.
• Direct third-party risk management for cloud and fintech relationships.
• Bridge outsourced CISO with internal policy and board reporting.
• Transition from outsourced to internal information security team with org design.

Skills

ISO Standards

Presentations

Access Management Governance

Incident Response

Regulatory Examination & Audit

Executive & Board Reporting

COBIT

Security Technologies

Attention to Detail

Facilitation

Identity Management Governance

Cloud & SaaS Security

Education

Bachelor's degree in Computer Science/Information Security/Information Technology

CISSP

CISM

CRISC

CISA

GIAC / GSEC

CCSK / CCSP

CGRC

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Information Security Officer

Full Time Professional College Walk, Honolulu, HI, US

2 days ago Requisition ID: 1198

Salary Range: $110,667.18 To $150,000.24 Annually

Key Responsibilities

• Own and maintain the written Information Security Program (ISP), incorporating guidance from OneStep and the Information Security Governance Committee, with accountability for the program’s adequacy to the Board, VP of ERM, and NCUA examiners.
• Conduct annual risk assessments of information systems, third-party vendors, and data flows.
• Oversee the incident response plan (IRP), including compliance with the NCUA 72-hour cyber incident notification rule.
• Direct vulnerability management, penetration testing, and patch management programs, coordinating execution across external IS consultants and IT Security.
• Lead vendor/third-party risk management for cloud, core processor, and fintech relationships, including ongoing due diligence and performance monitoring of OneStep as a critical vendor.
• Align business continuity/disaster recovery planning with information security controls.
• Deliver information security awareness training and phishing simulation programs to staff and the Board.
• Serve as primary point of contact for NCUA/state examiners on IT and cybersecurity exams, including the ACET (Automated Cybersecurity Examination Tool) process.
• Serve as the credit union’s primary internal liaison to the outsourced CISO (external consultant), translating security guidance and recommendations into internal policy, procedures, and Board reporting.
• Serve as an active member of the Information Security Governance Committee, coordinating between external consultant’s CISO recommendations and internal execution via IT Security.
• Partner with the VP of Enterprise Risk Management to lead the transition from outsourced information security support (external consultant) to an internal information security department, including org design, staffing plan, and phased capability build-out.
• Collaborate with the VP of ERM on decisions regarding which functions remain outsourced to external consultant versus insourced as the department matures.
• Integrate information security risk into the enterprise risk register and ERM reporting cycle, in coordination with the VP of Enterprise Risk Management.
• Ensure escalation to the Board/Risk Committee is preserved: ISP updates and material risk findings are escalated through the VP of ERM for inclusion in Board/Risk Committee reporting at least annually, with direct Board access maintained for significant incidents or unresolved risk disagreements.
• Establish Information Security requirements for cloud, SaaS hosted, and externally managed environments, including identity, encryption, logging, configuration management, data protection, and third-party connectivity.
• Monitor cybersecurity threats, vulnerabilities, regulatory alerts, financial-sector threat intelligence, and emerging technology risks, and assess their relevance and potential impact to the credit union.

Job Skills

• ISO Standards
• Presentations
• Access Management Governance
• Incident Response and Cyber Resilience
• Regulatory Examination and Audit Management
• Executive and Board Reporting
• Control Objectives for Information and Related Technologies (COBIT)
• Security Technologies and Architecture
• Attention to Detail
• Facilitation
• Identity Management Governance
• Cloud and SaaS Security

Qualifications & Experience

• 7+ years of progressively responsible experience in information security, cybersecurity, technology risk, information security governance, or a related discipline, with financial-services experience strongly preferred and credit-union experience highly desirable.
• Working knowledge of NCUA Part 748, GLBA, FFIEC guidance, and the ACET, NIST or equivalent framework.
• Three plus years in a leadership or supervisory capacity within information security, IT risk, or a related discipline required (e.g., team lead, security manager, or comparable supervisory role) recommended.
• Experience building or scaling an internal information security function, including staffing and organizational design, strongly preferred.
• Experience working within an enterprise risk management framework preferred.
• CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager) or equivalent senior information security certification required, CISSP and CISM combination preferred.
• CRISC (Certified in Risk and Information Systems Control) preferred.
• CISA (Certified Information Systems Auditor) preferred.
• GIAC (Global Information Assurance) / GSEC (GIAC Security Essentials) certifications preferred.
• CCSK (Certificate of Cloud Security Knowledge) /CCSP (Certified Cloud Security Professional) preferred.
• CGRC (Certified in Governance, Risk and Compliance) preferred.
• Computer Science (Bachelor's degree) or Information Security (Bachelor's degree) or Information Technology (Bachelor's degree) or equivalent experience.

Minimum Physical Requirements and Working Conditions

• Sitting for prolonged periods at a desk working on a computer.
• Frequent prolonged meetings in person or online.
• Traveling to various branches on occasion.
• Reaching, bending, twisting, turning on occasion.
• Lifting, pulling, pushing, and carrying up to 30 pounds on occasion.
• We'll make reasonable accommodations for qualified applicants and employees with disabilities.

Benefits and Pay

The expected pay for the Information Security Officer (ISO) is $110,667.18 to $150,000.24 per year.

We cover 100% of employees single medical, drug, vision, and dental monthly health insurance premiums.

Employees also love receiving paid volunteer time and our pay it forward program.

Tuition assistance for higher education is another special way we invest in our workforce.

Benefits include,

• Paid Time Off
• 401(k) and 3% Employer Contribution
• Health insurance
• Paid time off
• Vision insurance
• Dental insurance
• Prescription drug insurance
• Tuition reimbursement
• Life insurance
• Flexible spending account
• Disability insurance
• Health savings account
• Opportunities for advancement
• Employee assistance program
• Referral program
• Retirement plan
• Employee discount
• Paid training
• Professional development assistance
• AD&D insurance
• Volunteer time off
• Credit union membership
• Paid orientation
• and more.