Information Security Risk Officer

Job Description

JOB INFORMATION

Title:

Information Security Risk Officer

Officer Title:

AVP

Grade:

32

FLSA Classification:

Exempt

Date Last Edited:

10/8/2026

Reports To:

Chief Information Security Officer

Department:

Cybersecurity Governance and Risk

URL Link

https://hvfcu.jdxpert.com/ShowJob.aspx?EntityID=2&jobcode=787

PRIMARY FUNCTION

The Information Security Risk Officer (ISRO). Reporting to the Chief Information Security Officer, the ISRO provides leadership, direction, and coordinated oversight as the TPRM Liaison, HIPAA & Privacy function, Artificial Intelligence Subject Matter Expert, and Threat Analysis function. The ISRO establishes clear accountability, integrates risk information across these disciplines, provides independent challenges, escalates material concerns, and delivers decision-ready reporting to management and appropriate governance committees. The role partners with other second line risk functions including Cybersecurity Governance and Risk, Enterprise Risk Management, Legal & Compliance, Data Governance and AI Governance while coordinating with First Line risk functions of, Information Assurance, business lines, Technology, Procurement, and Third Line of Defense Internal Audit to protect member and organizational information, strengthen operational resilience, and support regulatory and examination readiness.

•

Lead and coordinate the Cybersecurity Governance & Risk responsibilities assigned to the ISRO function, including TPRM liaison, HIPAA and privacy, artificial intelligence risk, and threat analysis.

•

Establish role expectations, work priorities, decision rights, escalation paths, service levels, and performance measures for aligned functions; provide independent, risk-based oversight and effective challenge of cybersecurity and technology risk decisions.

•

Evaluate control design and operating effectiveness across business processes, information systems, cloud services, data environments, third parties, artificial intelligence use cases, and critical technology changes.

•

Coordinate cybersecurity policy exceptions and risk acceptances, including business justification, compensating controls, approval, expiration, and periodic reassessment.

•

Consolidate risk themes, trends, exceptions, issues, remediation status, audit and examination matters, and emerging concerns into clear management and governance committee reporting.

•

Provide cybersecurity risk leadership and functional direction for third-party risk activities, including risk tiering, due diligence, contract security requirements, assurance review, ongoing monitoring, issue management, risk acceptance, renewal, and termination.

•

Partner with Enterprise Risk Management, Procurement, Legal, Compliance, Vendor Management, Technology, Privacy, business relationship owners, and other stakeholders to integrate cybersecurity, privacy, resilience, and data protection requirements throughout the third-party lifecycle.

•

Monitor third-party and fourth-party findings, control changes, incidents, concentration risk, cloud risk, service resilience, and remediation commitments; escalate risks outside approved tolerance and produce related metrics, portfolio insights, and examination-ready evidence.

•

Provide coordinated oversight for HIPAA and privacy-related cybersecurity risks, including risk assessments for systems, business processes, third parties, data sharing, cloud services, and change initiatives involving protected, confidential, or regulated information.

•

Partner with Legal, Compliance, Data Governance, Technology, Incident Response, business owners, and third-party stakeholders on privacy-by-design, minimum-necessary access, data lifecycle safeguards, incident and breach assessment support, control requirements, and evidence readiness.

•

Provide leadership for AI risk oversight and represent cybersecurity risk in enterprise AI Governance and Data Governance activities, including intake, inventory, tiering, assessment, approval, testing, documentation, monitoring, exception, and escalation expectations for AI use cases and AI-enabled services.

•

Coordinate with cybersecurity operations, incident response, fraud, IT, Enterprise Risk Management, business continuity, third-party risk, and other stakeholders to validate threats, align response priorities, and avoid duplicative operational responsibilities.

•

Serve as a trusted risk advisor by communicating complex technical, privacy, third-party, AI, and threat information in clear business terms for leaders, committees, auditors, and examiners.

•

Maintain current knowledge of evolving threats, technologies, laws, regulations, supervisory expectations, and industry practices relevant to assigned functions.

•

Assess and communicate AI risks involving security, privacy, data quality, intellectual property, explainability, transparency, bias or harmful outcomes, output reliability, human oversight, misuse, prompt injection, data leakage, model drift, third-party dependency, and operational resilience.

•

Provide direction for threat analysis activities so relevant internal and external threat information informs governance, risk assessments, control assurance, third-party oversight, strategic planning, executive reporting, and remediation priorities.

•

Oversee analysis of threat actors, tactics, techniques, procedures, vulnerabilities, attack trends, fraud and social-engineering patterns, geopolitical or sector developments, and emerging technology risks relevant to the Credit Union.

•

Translate threat analysis into actionable risk scenarios, control priorities, assessment focus areas, tabletop or exercise inputs, awareness topics, and remediation recommendations; escalate credible or material threat developments when changes to risk treatment, monitoring, resilience, or governance are warranted.

•

Adhere to all Credit Union policies, procedures, and regulatory agency requirements. Participate in all required and recommended training and development including, but not limited to, Bank Secrecy Act training (BSA) and demonstrate attained knowledge. Participate on Credit Union teams, projects and strategic initiatives when the opportunity arises. Perform additional duties and special projects as assigned.

•

Embrace and apply HVCU’s guiding principles to all activities and responsibilities. This includes the Credit Union’s Mission, Vision, Core Values, Employee and Member Value Propositions, Sales and Service Model, and commitment to Lean Six Sigma practices. Support the Credit Union’s initiatives by demonstrating teamwork and professionalism.

•

Responsible for regular and predictable attendance including punctuality.

Bachelor’s Degree

Related technical, law or security field - Computer Science, Information Technology or equivalent

X

CISSP, SSCP, CISM, CEH

X

Minimum 5 Years

Leadership

X

Minimum 10 Years

Progressive experience in cybersecurity governance, enterprise risk management, HIPAA and privacy, control assurance, audit and examination readiness, and regulatory compliance within financial services or another highly regulated environment.              

X

•

Ability to think strategically and develop long-term security plans.

•

Advanced proficiency in Microsoft Office Software (Word, Excel, Outlook, PowerPoint, etc.)

•

Ability to communicate complex concepts to non-technical stakeholders and build a culture of security awareness.

•

Strong working knowledge of second-line oversight, independent challenge, risk appetite and tolerance, issue and exception management, executive escalation, governance committee reporting, and relevant cybersecurity, privacy, AI, and third-party risk frameworks and regulatory guidance.

•

Advanced verbal, written and presentation skills.

•

Must be able to demonstrate advanced analytical, communication and interpersonal skills.

•

Ability to lead through influence, establish accountability across matrixed teams, and coordinate work among business, technology, risk, legal, compliance, privacy, procurement, audit, and operational stakeholders.

•

Ability to synthesize diverse risk information into clear priorities, decisions, escalations, metrics, and executive or Board-level reporting.

•

Proficiency with Microsoft Office, collaboration, reporting, GRC, TPRM, data analysis, threat intelligence, and visualization tools appropriate to the role.

•

Ability to effectively communicate with Senior Management.

•

Ability to work in a fast-paced environment and deal with a variety of internal/external customer and vendor situations.

PHYSICAL DEMANDS

Frequency

Physical Demand

Weight (lbs.)

Frequently

Sit for prolonged periods of time

Frequently

Required to communicate verbally

Frequently

Normal range of vision and hearing abilities required

Occasionally

Lift and/or move objects

10

Occasionally

Travel outside of work location to attend meetings and training programs

Frequently

Required to skillfully operate a computer, telephone and other standard office equipment

WORK ENVIRONMENT

•

Typically the noise level in the work environment is low to moderate.

•

May experience occasional job stress in dealing with difficult situations and/or high volume.

•

High energy, high impact atmosphere.

•

There are no significant hazardous conditions.

View Competencies

Leadership

Leads people towards meeting the organization’s vision, mission, and goals. Provides an inclusive workplace that fosters diversity, development, teamwork and continuous improvement.

Level 3

1. Builds and manages workforce based on organizational goals and budgetary considerations. Drives ongoing workforce planning and succession to support future vision.    2. Develops networks and builds alliances; collaborates across boundaries to build strategic relationships and achieve common goals.  3. Looks towards the broadest possible view of an issue or challenge. Discusses multiple aspects and impacts of issues and projects them into the future.  4. Nurtures growth and development; promotes organizational learning within and across business units by providing challenging and stretching tasks and sharing key experiences.  5. Projects competence and composure. Communicates with credibility. Demonstrates situational- and self-awareness.

Strategic Visioning

Takes a long-term view and builds a shared vision within the organization; acts as a catalyst for organizational change. Influences others to translate vision into action.

Level 3

1. Facilitates cross-boundary communication to surface and resolve issues proactively.  2. Leads the organization to develop and translate strategy into operational goals and priorities.  3. Modifies the organizational structure to address strategic leadership and talent needs.  4. Sees beyond short term commitments to a long-term competitive, sustainable position.  5. Stays in touch with the evolving needs and demands of the market and looks for trends and new ideas that might affect the organization.

Service Excellence

Consistently incorporates Hudson Valley's member and employee value proposition, reinforcing organizational culture and brand differentiators.

Level 4

1. Champions culture, establishes clear organizational values, vision and strategy.   2. Creates the organization's business model and competitive position in the marketplace. Effectively communicates model to drive understanding and action throughout the organization.  3. Delivers upon the member value proposition by providing a product line that meets and exceeds expectations.  4. Enhances brand awareness by keeping messages focused and consistent with the business strategy. Leads through principled and consistent communications even when addressing difficult subjects.

Resiliency

Adapts positively to changing environments in order to achieve business results.

Level 3

1. Encourages new ideas and innovations; designs and implements new or cutting edge programs/processes.  2. Establishes programs that result in continuous improvement through innovation and lean thinking.   3. Guides others to understand and accept change more readily. Directs team through ambiguity to ensure ongoing success.   4. Leads a continuous cycle of innovation that incorporates feedback and lean thinking to improve future initiatives.  5. Remains in touch with the evolving needs and demands of the market and looks for trends and new ideas that might affect the organization.

Results Driven

Drives critical activities to completion. Meets organizational goals and customer expectations.

Level 3

1. Conducts ongoing organizational unit performance and risk analysis, recognizing strategic opportunities for success as well as potential risks. Adjusts strategies to address opportunities as well as potential risks to ensure attainment of business unit targets.  2. Evaluates organizational benefits and impacts of regulations. Creates standards and business processes to ensure regulatory compliance.  3. Leads organizational units to drive critical activities to completion. Demonstrates how units contribute to organizational results.  4. Sets operational productivity measures in terms consistent with business strategy. Defines responsibilities and processes for monitoring, communicating progress, and measuring results.

This job description is not designed to cover or contain a comprehensive listing of activities, duties, or responsibilities that are required of the employee in this position.  Additional functions and requirements may be assigned by supervisors as deemed appropriate, with or without notice.

Nothing contained in this material creates a contract of employment between an employee and Hudson Valley Federal Credit Union or otherwise alters the at-will nature of the employment relationship.

Are you able to perform the essential functions listed in this job description with or without reasonable accommodation?  YES_______  NO_______

By signing below you certify that you have received this job description and understand the requirements, essential functions and duties of the position.  If you are currently employed in this position, your signature acknowledge that this job description accurately describes the position, including its essential functions.

Name:  _____________________________________________

Signature: _____________________________________________

Date:  _____________________________________________ 

Please also note that Hudson Valley Federal Credit Union respects the religious beliefs and practices of employees and will, on request, reasonably accommodate its employees when a reasonable accommodation is available that does not create an undue hardship on the Credit Union’s business.  Therefore, unavailability for work due to religious observances or practices may not be a bar to employment.