Chief Information Security Officer

WHO ARE WE: Alerus is a commercial wealth bank and national retirement provider with one core purpose: helping clients achieve their financial goals. We are driven by a shared commitment to always do the right thing; leading with integrity and providing valued advice and guidance to our clients. We value the expertise and skillsets each team member provides and encourage collaboration innovation adaptability and an entrepreneurial spirit at all levels of our company. By consistently seeking improvements and growth we foster long-term relationships with clients and team members. We are proud to be recognized as a Top Workplace by numerous industry and regional outlets.

CORE VALUES: Passion for Excellence :: Success is Never Final :: Do the Right Thing :: One Alerus

ABOUT THE ROLE:

The Vice President Chief Information Security Officer (CISO) is the senior executive responsible for establishing leading and continuously maturing the organizations enterpriseâwide information security strategy reporting directly to the Chief Risk Officer. This role oversees the development implementation and governance of security policies programs and technologies designed to protect the confidentiality integrity and availability of customer employee and institutional data across all lines of business. The CISO operates closely with senior leadership technology teams risk functions and business units to ensure security is embedded into organizational strategy operations and culture. The CISO will be a part of IT Management to ensure the Companys technology environment matures and evolves to mitigate current and future information security risks. This position serves as the primary resource for cybersecurity to executive management the Board of Directors and bank regulators and acts as a trusted advisor on emerging cyber threats technology risk and digital resilience.

WHAT YOULL BE DOING:

• Develop implement and continuously update the companys multi-year information security strategy roadmap and operating plan consistent with business objectives and risk appetite; define measurable outcomes and security program maturity targets.
• Establish and maintain information security policies standards and procedures aligned with applicable banking laws and regulations and recognized frameworks including FFIEC guidance the NIST Cybersecurity Framework and CIS Controls.
• Ensure systems compliance with security policies standards and practices. Recommend and direct the implementation of solutions for non-compliant systems.
• Establish enterprise security architecture requirements across cloud on-premises third-party and hybrid environments; conduct or approve security design reviews for material technology changes.
• Monitor the evolving threat and regulatory environment including risks arising from cloud artificial intelligence and digital banking technologies; adjust strategy controls and resourcing accordingly and advise cross functional leadership on impacts to the company.
• Direct vulnerability management penetration testing attack-surface management and remediation governance including risk-based prioritization and escalation of overdue critical issues.
• Direct security operations threat intelligence threat hunting monitoring detection and response activities including the effective oversight of managed security service providers.
• Own maintain and regularly test the companys Computer Security Incident Response Plan through tabletop exercises and simulations; serve as executive incident commander for material events and coordinate containment recovery communications regulatory notifications and post-incident reviews with Legal Compliance Fraud Risk and business leaders.
• Lead and advise on control framework for identity and access management data classification encryption data loss prevention endpoint and network security cloud security application security and secure software development and DevSecOps control frameworks.
• Lead enterprise cybersecurity risk assessments and security program maturity assessments; identify critical systems data and business services and verify that risk treatment plans and controls provide appropriate protection.
• Own the information security budget workforce plan and external service strategy; work with IT leadership team and business leaders to prioritize investments based on risk reduction business impact regulatory expectations and sound financial analysis.
• Lead cybersecurity oversight across the third-party lifecycle including due diligence contract security requirements ongoing monitoring concentration and supply-chain risk issue remediation and secure termination.
• Serve as the primary cybersecurity subject matter expert and point of contact for internal and external audits and regulatory examinations; coordinate responses to findings corrective action plans and remediation timelines with Internal Audit and external auditors and examiners.
• Partner with Business Continuity Technology Operations and Risk to establish and regularly test cyber recovery disaster recovery and operational resilience plans for critical business services and technology dependencies.
• Collaborate with Legal and Compliance to ensure ongoing compliance with GLBA Section 501(b) and related Interagency Guidelines PCI DSS Sarbanes-Oxley requirements and applicable state privacy and breach-notification laws.
• Maintain documentation and evidence necessary to demonstrate control design and operating effectiveness during regulatory reviews audits client due diligence and cyber insurance underwriting.
• Partner with Enterprise Risk to develop validate and report key risk indicators key performance indicators control effectiveness program maturity material issues and remediation aging to the Enterprise Risk Management Committee and Risk Committee.
• Partner with Risk to ensure cyber risk is appropriately incorporated into the Banks overall risk appetite statement and ERM framework.
• Present quarterly or more frequently as needed to the Board Risk Committee on cybersecurity risk posture program effectiveness and maturity roadmap progress emerging threats material incidents regulatory posture and investment priorities.
• Provide clear board-appropriate cybersecurity risk reporting and translate technical risk into business impact for non-technical stakeholders.
• Design and oversee an enterprise security awareness and role-based training program including phishing simulations and effectiveness measures that reflect current threats and employee responsibilities.
• Build lead and develop a high-performing information security team including succession planning and staff development.
• Partner with Data Technology Legal Compliance and Risk leaders to establish security requirements and governance for artificial intelligence systems and third-party AI tools including data use access monitoring and incident response.
• Other duties as assigned.

WHAT YOU SHOULD HAVE:

• Bachelors degree in computer science cybersecurity management information systems or a related field or an equivalent combination of education and relevant experience.
• 10 years of progressive information security experience with at least 5 years in a leadership role.
• Demonstrated experience building and maturing an enterprise information security program in a regulated financial institution or comparably regulated environment.
• Executive-level communication and influence skills including experience translating technical risk into business impact for executive leadership board committees regulators and non-technical stakeholders.
• Experience leading enterprise cyber risk assessments security architecture vulnerability management penetration testing remediation governance and control-effectiveness testing.
• Experience with developing and providing an information security awareness and training program.
• Experience with developing and maintaining information security policies and standards.
• Demonstrated command of the NIST Cybersecurity Framework FFIEC IT Examination Handbook guidance CIS Controls and banking regulatory expectations; working knowledge of ISO 27001 and SOC 2.
• Practical technical depth in cloud and hybrid architecture network and endpoint security identity and access management encryption data protection application security and secure software development.
• Knowledge of GLBA Section 501(b) related Interagency Guidelines PCI DSS Sarbanes-Oxley requirements state privacy and breach-notification laws and relevant federal and state banking regulatory expectations.
• Current Certified Information Systems Security Professional certification; CISM CISA CRISC or CCSP certification preferred.

PREFERRED ATTRIBUTES:

• Experience leading information security within banking wealth management retirement services payments or another regulated financial services organization.
• Experience with banking regulatory examinations audit remediation and executive and board reporting.
• Hands-on leadership experience in cloud security secure architecture DevSecOps and technology transformation.
• High ethical standards sound judgment under pressure and a strong commitment to protecting clients and the company.
• Experience building security teams and effectively managing co-sourced security capabilities managed security service providers and specialized consultants.

WHAT WE BRING TO THE TABLE:

• Competitive compensation including base salary bonus and/or incentive opportunities.
• Comprehensive benefits package providing a wide range of health and well-being benefits including medical dental vision life and long-term disability insurance; and 401(k) and ESOP for retirement savings.
• Generous paid time off programs such as flexible time off company-paid holidays parental and bereavement leave.
• Learning and development resources for personal and professional career development and advancement opportunities.
• Access to financial experts for guidance financial wellness tools and discounts on Alerus products and services.
• Support for the communities we live in through paid volunteer time and a company donation match opportunity.

WORK ENVIRONMENT: Work is typically performed in an office setting. The employee is regularly required to sit for extended periods of time. The employee is occasionally required to move about the office utilizing proper ergonomic safeguards when doing so. Additionally the employee must occasionally lift or move supplies and materials up to 20 pounds.

BASE PAY RANGE:

$200000 - $250000 annually

The above information in this description has been designed to indicate the general nature and level of work performed by employees in this position. It is not designed to contain or be interpreted as an exhaustive list of all responsibilities duties and qualifications required of employees assigned to this job.

Alerus is an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race religion color national origin gender sexual orientation age marital status veteran status or disability status.

Required Experience:

Chief