Information Security Risk Officer

Hvcu; Town of Poughkeepsie (NY); Presencial; USD 120 000 - 160 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Base & Variable Pay Structures

Paid Personal, Holiday & VolunteerTime

Professional Development & Training

Student Loan Repayment & Tuition Reimb

Medical, Dental & Vision Coverage

401(k) With Employer Match

Life, Disability Insurances

Discounted Loan Rates & Fees

Resumo da oferta

Hudson Valley Credit Union seeks an Information Security Risk Officer to lead TPRM, HIPAA/privacy, AI risk, and threat analysis. The ISRO coordinates across second and first line risk, governance committees, and business lines to protect member data and strengthen resilience.

The role requires senior leadership, extensive experience in cybersecurity governance, enterprise risk management, and regulatory compliance within financial services; CISSP/SSCP/CISM/CEH are required.

Qualificações

• Bachelor's Degree in related technical, law or security field required.
• Minimum 5 years leadership experience.
• Minimum 10 years progressive experience in cybersecurity governance, risk management, HIPAA/privacy, and regulatory compliance.
• CISSP, SSCP, CISM, CEH required.

Responsabilidades

• Lead and coordinate Cybersecurity Governance & Risk responsibilities within ISRO, including TPRM liaison, AI risk, and threat analysis.
• Establish role expectations, escalation paths, and performance measures; provide independent oversight.
• Evaluate control design and operating effectiveness across processes, systems, and third parties.
• Coordinate policy exceptions, risk acceptances, and remediation status reporting.
• Consolidate risk themes and provide management-facing reporting for governance committees.
• Provide risk leadership for third-party activities across lifecycle.
• Partner with ERP, Legal, Compliance, Vendor Management, Technology, Privacy, and other stakeholders.
• Monitor third-party findings, incidents, and remediation commitments; elevate risks as needed.
• Provide HIPAA/privacy-related cybersecurity risk oversight and assessments.
• Partner on privacy-by-design, data lifecycle safeguards, and evidence readiness.
• Lead AI risk oversight within enterprise AI/Data Governance activities.
• Translate threat analysis into actionable risk scenarios and remediation priorities.
• Communicate complex risk information in clear business terms to leaders and auditors.
• Maintain knowledge of evolving threats, regulations, and industry practices.

Conhecimentos

Leadership

Governance

Risk Management

HIPAA Privacy

Threat Analysis

AI Governance

Formação académica

Bachelor's Degree in Related field

Descrição da oferta de emprego

Overview

Hudson Valley Credit Union is currently recruiting for the position of Information Security Risk Officer. Primary Function: provides leadership, direction, and coordinated oversight as the TPRM Liaison, HIPAA & Privacy function, Artificial Intelligence Subject Matter Expert, and Threat Analysis function. The ISRO establishes clear accountability, integrates risk information across these disciplines, provides independent challenges, escalates material concerns, and delivers decision-ready reporting to management and appropriate governance committees. The role partners with other second line risk functions including Cybersecurity Governance and Risk, Enterprise Risk Management, Legal & Compliance, Data Governance and AI Governance while coordinating with First Line risk functions of, Information Assurance, business lines, Technology, Procurement, and Third Line of Defense Internal Audit to protect member and organizational information, strengthen operational resilience, and support regulatory and examination readiness.

Responsibilities

• Lead and coordinate the Cybersecurity Governance & Risk responsibilities assigned to the ISRO function, including TPRM liaison, HIPAA and privacy, artificial intelligence risk, and threat analysis.
• Establish role expectations, work priorities, decision rights, escalation paths, service levels, and performance measures for aligned functions; provide independent, risk-based oversight and effective challenge of cybersecurity and technology risk decisions.
• Evaluate control design and operating effectiveness across business processes, information systems, cloud services, data environments, third parties, artificial intelligence use cases, and critical technology changes.
• Coordinate cybersecurity policy exceptions and risk acceptances, including business justification, compensating controls, approval, expiration, and periodic reassessment.
• Consolidate risk themes, trends, exceptions, issues, remediation status, audit and examination matters, and emerging concerns into clear management and governance committee reporting.
• Provide cybersecurity risk leadership and functional direction for third-party risk activities, including risk tiering, due diligence, contract security requirements, assurance review, ongoing monitoring, issue management, risk acceptance, renewal, and termination.
• Partner with Enterprise Risk Management, Procurement, Legal, Compliance, Vendor Management, Technology, Privacy, business relationship owners, and other stakeholders to integrate cybersecurity, privacy, resilience, and data protection requirements throughout the third-party lifecycle.
• Monitor third-party and fourth-party findings, control changes, incidents, concentration risk, cloud risk, service resilience, and remediation commitments; elevate risks outside approved tolerance and produce related metrics, portfolio insights, and examination-ready evidence.
• Provide coordinated oversight for HIPAA and privacy-related cybersecurity risks, including risk assessments for systems, business processes, third parties, data sharing, cloud services, and change initiatives involving protected, confidential, or regulated information.
• Partner with Legal, Compliance, Data Governance, Technology, Incident Response, business owners, and third-party stakeholders on privacy-by-design, minimum-necessary access, data lifecycle safeguards, incident and breach assessment support, control requirements, and evidence readiness.
• Provide leadership for AI risk oversight and represent cybersecurity risk in enterprise AI Governance and Data Governance activities, including intake, inventory, tiering, assessment, approval, testing, documentation, monitoring, exception, and escalation expectations for AI use cases and AI-enabled services.
• Coordinate with cybersecurity operations, incident response, fraud, IT, Enterprise Risk Management, business continuity, third-party risk, and other stakeholders to validate threats, align response priorities, and avoid duplicative operational responsibilities.
• Serve as a trusted risk advisor by communicating complex technical, privacy, third-party, AI, and threat information in clear business terms for leaders, committees, auditors, and examiners.
• Maintain current knowledge of evolving threats, technologies, laws, regulations, supervisory expectations, and industry practices relevant to assigned functions.
• Assess and communicate AI risks involving security, privacy, data quality, intellectual property, explainability, transparency, bias or harmful outcomes, output reliability, human oversight, misuse, prompt injection, data leakage, model drift, third-party dependency, and operational resilience.
• Provide direction for threat analysis activities so relevant internal and external threat information informs governance, risk assessments, control assurance, third-party oversight, strategic planning, executive reporting, and remediation priorities.
• Oversee analysis of threat actors, tactics, techniques, procedures, vulnerabilities, attack trends, fraud and social-engineering patterns, geopolitical or sector developments, and emerging technology risks relevant to the Credit Union.
• Translate threat analysis into actionable risk scenarios, control priorities, assessment focus areas, tabletop or exercise inputs, awareness topics, and remediation recommendations; elevate credible or material threat developments when changes toward risk treatment, monitoring, resilience, or governance are warranted.
• Adhere to all Credit Union policies, procedures, and regulatory agency requirements. Participate in all required and recommended training and development including, but not limited to, Bank Secrecy Act training (BSA) and demonstrate attained knowledge. Participate on Credit Union teams, projects and strategic initiatives when the opportunity arises. Perform additional duties and special projects as assigned.
• Embrace and apply HVCU's guiding principles to all activities and responsibilities. This includes the Credit Union's Mission, Vision, Core Values, Employee and Member Value Propositions, Sales and Service Model, and commitment to Lean Six Sigma practices. Support the Credit Union's initiatives by demonstrating teamwork and professionalism.
• Responsible for regular and predictable attendance including punctuality.

Qualifications

• Bachelor's Degree in Related technical, law or security field - Computer Science, Information Technology or equivalent required.
• Minimum 5 Years leadership experience required.
• Minimum 10 Years Progressive experience in cybersecurity governance, enterprise risk management, HIPAA and privacy, control assurance, audit and examination readiness, and regulatory compliance within financial services or another highly regulated environment required.
• CISSP, SSCP, CISM, CEH required.

Click here to view full job description

Why Choose HVCU?

Join a team where your growth matters. At Hudson Valley Credit Union, we offer a supportive, community-focused culture, competitive benefits, and opportunities to grow your career while making a meaningful impact. Come be part of a Great Place to Work!

Employee Perks:

• Base & Variable Pay Structures
• Paid Personal, Holiday & Volunteer Time Off
• Professional Development & Training
• Student Loan Repayment & Tuition Reimbursement Programs
• Medical, Dental & Vision Coverage
• 401(k) With Employer Match & Non-elective Employer Contribution
• Life, Short-term & Long-term Disability Insurances
• Discounted Loan Rates & Fees

Hudson Valley Federal Credit Union is an AA/EEO employer committed to equal opportunity and employee diversity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, sexual orientation, gender identity, national origin, disability, military or veteran status, genetic information, marital or familial status, domestic violence victim status, or any other characteristic protected by law.