Information Security Risk Officer

Overview

Hudson Valley Credit Union is currently recruiting for the position of Information Security Risk Officer. Primary Function: provides leadership, direction, and coordinated oversight as the TPRM Liaison, HIPAA & Privacy function, Artificial Intelligence Subject Matter Expert, and Threat Analysis function. The ISRO establishes clear accountability, integrates risk information across these disciplines, provides independent challenges, escalates material concerns, and delivers decision-ready reporting to management and appropriate governance committees. The role partners with other second line risk functions including Cybersecurity Governance and Risk, Enterprise Risk Management, Legal & Compliance, Data Governance and AI Governance while coordinating with First Line risk functions of, Information Assurance, business lines, Technology, Procurement, and Third Line of Defense Internal Audit to protect member and organizational information, strengthen operational resilience, and support regulatory and examination readiness.

Responsibilities

• Lead and coordinate the Cybersecurity Governance & Risk responsibilities assigned to the ISRO function, including TPRM liaison, HIPAA and privacy, artificial intelligence risk, and threat analysis. 
• Establish role expectations, work priorities, decision rights, escalation paths, service levels, and performance measures for aligned functions; provide independent, risk-based oversight and effective challenge of cybersecurity and technology risk decisions. 
• Evaluate control design and operating effectiveness across business processes, information systems, cloud services, data environments, third parties, artificial intelligence use cases, and critical technology changes. 
• Coordinate cybersecurity policy exceptions and risk acceptances, including business justification, compensating controls, approval, expiration, and periodic reassessment. 
• Consolidate risk themes, trends, exceptions, issues, remediation status, audit and examination matters, and emerging concerns into clear management and governance committee reporting. 
• Provide cybersecurity risk leadership and functional direction for third-party risk activities, including risk tiering, due diligence, contract security requirements, assurance review, ongoing monitoring, issue management, risk acceptance, renewal, and termination. 
• Partner with Enterprise Risk Management, Procurement, Legal, Compliance, Vendor Management, Technology, Privacy, business relationship owners, and other stakeholders to integrate cybersecurity, privacy, resilience, and data protection requirements throughout the third-party lifecycle. 
• Monitor third-party and fourth-party findings, control changes, incidents, concentration risk, cloud risk, service resilience, and remediation commitments; escalate risks outside approved tolerance and produce related metrics, portfolio insights, and examination-ready evidence. 
• Provide coordinated oversight for HIPAA and privacy-related cybersecurity risks, including risk assessments for systems, business processes, third parties, data sharing, cloud services, and change initiatives involving protected, confidential, or regulated information. 
• Partner with Legal, Compliance, Data Governance, Technology, Incident Response, business owners, and third-party stakeholders on privacy-by-design, minimum-necessary access, data lifecycle safeguards, incident and breach assessment support, control requirements, and evidence readiness. 
• Provide leadership for AI risk oversight and represent cybersecurity risk in enterprise AI Governance and Data Governance activities, including intake, inventory, tiering, assessment, approval, testing, documentation, monitoring, exception, and escalation expectations for AI use cases and AI-enabled services.
• Coordinate with cybersecurity operations, incident response, fraud, IT, Enterprise Risk Management, business continuity, third-party risk, and other stakeholders to validate threats, align response priorities, and avoid duplicative operational responsibilities. 
• Serve as a trusted risk advisor by communicating complex technical, privacy, third-party, AI, and threat information in clear business terms for leaders, committees, auditors, and examiners. 
• Maintain current knowledge of evolving threats, technologies, laws, regulations, supervisory expectations, and industry practices relevant to assigned functions. 
• Assess and communicate AI risks involving security, privacy, data quality, intellectual property, explainability, transparency, bias or harmful outcomes, output reliability, human oversight, misuse, prompt injection, data leakage, model drift, third-party dependency, and operational resilience. 
• Provide direction for threat analysis activities so relevant internal and external threat information informs governance, risk assessments, control assurance, third-party oversight, strategic planning, executive reporting, and remediation priorities.
• Oversee analysis of threat actors, tactics, techniques, procedures, vulnerabilities, attack trends, fraud and social-engineering patterns, geopolitical or sector developments, and emerging technology risks relevant to the Credit Union.
• Translate threat analysis into actionable risk scenarios, control priorities, assessment focus areas, tabletop or exercise inputs, awareness topics, and remediation recommendations; escalate credible or material threat developments when changes to risk treatment, monitoring, resilience, or governance are warranted. 
• Adhere to all Credit Union policies, procedures, and regulatory agency requirements. Participate in all required and recommended training and development including, but not limited to, Bank Secrecy Act training (BSA) and demonstrate attained knowledge. Participate on Credit Union teams, projects and strategic initiatives when the opportunity arises. Perform additional duties and special projects as assigned.
  
• Embrace and apply HVCU’s guiding principles to all activities and responsibilities. This includes the Credit Union’s Mission, Vision, Core Values, Employee and Member Value Propositions, Sales and Service Model, and commitment to Lean Six Sigma practices. Support the Credit Union’s initiatives by demonstrating teamwork and professionalism.
  
• Responsible for regular and predictable attendance including punctuality.
  

Qualifications

• Bachelor’s Degree in Related technical, law or security field - Computer Science, Information Technology or equivalent required.
• Minimum 5 Years leadership experience required.
• Minimum 10 Years Progressive experience in cybersecurity governance, enterprise risk management, HIPAA and privacy, control assurance, audit and examination readiness, and regulatory compliance within financial services or another highly regulated environment required.
• CISSP, SSCP, CISM, CEH  required.

Click here to view full job description

Why Choose HVCU?

Join a team where your growth matters. At Hudson Valley Credit Union, we offer a supportive, community-focused culture, competitive benefits, and opportunities to grow your career while making a meaningful impact. Come be part of a Great Place to Work! 

Employee Perks:

• Base & Variable Pay Structures

• Paid Personal, Holiday & Volunteer Time Off

• Professional Development & Training

• Student Loan Repayment & Tuition Reimbursement Programs

• Medical, Dental & Vision Coverage

• 401(k) With Employer Match & Non-Elective Employer Contribution

• Life, Short-term & Long-term Disability Insurances

• Discounted Loan Rates & Fees 

Hudson Valley Federal Credit Union is an AA/EEO employer committed to equal opportunity and employee diversity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, sexual orientation, gender identity, national origin, disability, military or veteran status, genetic information, marital or familial status, domestic violence victim status, or any other characteristic protected by law.