Director, Information Security

Requirements:

• Bachelors degree in information technology, cybersecurity, information systems, or a closely related field, plus at least three years of relevant professional experience; or an associate degree or certificate in a related field plus at least five years of experience; or at least seven years of relevant experience in lieu of a degree or certificate.
• Experience in financial, medical, Department of Defense, or another highly regulated environment.
• Demonstrated expertise in network and data security practices, incident prevention and response, audits and regulatory examinations, GRC frameworks, and third-party risk management.
• Advanced knowledge of network and endpoint security, cloud security, identity and access management, SIEM and logging, vulnerability management, and vendor risk.
• CISSP, CISA, CISM, GIAC, or CRISC certification preferred.
• Ability to handle highly confidential information discreetly.
• Strong analytical, organizational, prioritization, and executive communication skills, including the ability to communicate with staff across technical skill levels.
• Availability to work outside standard business hours, including evenings, weekends, or holidays, when needed.

Responsibilities:

• Advise leadership, committees, working groups, and stakeholders on cybersecurity strategy, and develop and mature a program aligned with business objectives, compliance obligations, risk frameworks, and organizational strategy.
• Maintain a resilient security posture in response to evolving threats.
• Develop and continuously improve the Information Security Policy and Program in alignment with applicable standards and requirements, including GLBA, FDIC, NCUA, CIS, NIST, and PCI.
• Prepare and present the annual Information Security Program report to the Board, and develop policies and procedures for review by the Information Technology Steering Committee.
• Administer security risk assessments, identify vulnerabilities, prioritize remediation, and establish and monitor security metrics and key risk indicators.
• Provide expertise on AI and emerging-technology risk governance and contribute to security budget planning.
• Direct third-party information security risk management, including due diligence, SOC 1 and SOC 2 report reviews, and validation of vendor user-control requirements.
• Conduct identity and access governance reviews, collaborate on data classification, oversee cloud security, and advise on project and change security reviews.
• Serve as the information security liaison to regulators, examiners, and external auditors.
• Administer employee security policy exceptions through established approval processes.
• Oversee incident response risk monitoring, investigations, root-cause analysis, escalation, remediation, and reporting.
• Manage vulnerability reporting and support timely identification and remediation of system vulnerabilities.
• Oversee key cybersecurity technologies, including SIEM, antivirus and antimalware, and endpoint protection, in collaboration with internal teams and external vendors.
• Provide threat intelligence and cyber insurance support, and escalate significant security issues and vulnerabilities while recommending appropriate actions.
• Manage employee security awareness education, testing, and compliance reporting.
• Partner with internal departments to integrate security into business processes, system designs, and technology deployments.
• Participate in special projects and perform other assigned duties.
• Follow company policies and procedures, complete annual compliance training, and comply with business continuity, vendor management, anti-money laundering, Bank Secrecy Act, OFAC, and USA PATRIOT Act requirements, including applicable identification, due diligence, screening, and reporting processes.
• Supervise up to two employees in accordance with organizational policies and applicable laws.
• Promote our culture, purpose, and values through integrity, accountability, and collaboration.

Technologies:

• AI
• Cloud
• Support
• Network
• Security
• IAM

More

We are BluPeak, and this Director of Information Security role is based at our corporate office in San Diego, California. It is a regular, full-time position within Information Technology and our Risk Management team, serving as the Information Security Officer and providing independent second-line risk oversight. The role protects member and business information across our technology systems and third-party services while partnering with technology and business teams and senior leadership. We offer a culture centered on accountability, high performance, professionalism, authenticity, meaningful contribution, and connection to our purpose and vision.

last updated 43 week of 2026