Chief Information Security Officer (CISO)

Role

Security Strategy and Governance

• Define and maintain a multi-year cybersecurity strategy aligned with business growth, risk appetite, and regulatory obligations.
• Establish and maintain an information security policy framework reviewed at least annually.
• Maintain the cyber risk register and security maturity roadmap against NIST CSF, CIS Controls, or ISO 27001.
• Own the security risk acceptance and exception register.
• Provide security leadership and advisory support to executive management and regulatory stakeholders.

Threat and Vulnerability Management

• Direct enterprise vulnerability management, including scanning, risk-based prioritization, and remediation SLA enforcement.
• Oversee penetration testing and ensure findings are remediated and retested within defined timelines.
• Maintain threat intelligence relevant to financial services and payments and translate it into detection and control improvements.

Security Operations

• Oversee security monitoring, detection, and response capabilities, including SIEM, EDR/XDR, and internal or MSSP-managed SOC operations.
• Own end-to-end incident response, including playbooks, tabletop exercises, containment, recovery, and regulatory notification.
• Manage identity and access governance, including RBAC, privileged access management, joiner/mover/leaver controls, and periodic access recertification.
• Define and enforce data loss prevention and data classification standards across all platforms.

Requirements

• Operate cybersecurity and information security programs within a regulated financial services environment.
• Apply a recognized security control framework such as NIST CSF, CIS Controls, or ISO 27001.
• Understand cloud-native payments and stored value facility operations.