AVP, Information Security (Redwood City, CA)
*** We do not sponsor employment/work visas at this time, if you need sponsorship now or in the future, unfortunately, your application will not be considered ***
JOB SUMMARY
The AVP, Information Security leads PCU’s enterprise information security program, reporting to the Chief Information Security Officer. This role assists with the building and development of a high-performing security organization and helps the VP define the security strategy and roadmap across hybrid cloud, AI security and governance, data protection, and emerging technology risk. The AVP directs security awareness and human risk management, risk-based vulnerability and exposure management, and modernized security operations and incident response using AI, automation, and threat intelligence. The role also provides leadership for GRC, third-party risk, independent assessments, new security risk assessments, security technology lifecycle and vendor management, including oversight of 24x7 security service providers. The AVP maintains policies, standards, and guidelines aligned with NIST, NCUA, and other regulatory requirements, and reports program health, KPIs, and metrics to leadership to strengthen PCU’s cyber resilience.
Why Provident?
Provident Credit Union was established in 1950, and we rank among the top 10% of credit unions in the US. We believe having a culture that is accepting, supportive, diverse, and inclusive makes us all better. Provident has been a Bay Area “Top Workplace” since 2017, and our employees rank us on Glassdoor as one of the best credit unions in the nation. Our values are:
- Listen
- Get Better
- Do What’s Right
Essential Functions
- Assist the VP in building, leading, and developing a high-performing security organization by aligning talent and resources with evolving cyber risks, strengthening technical and leadership capabilities, and fostering a culture of accountability, collaboration, innovation, and continuous improvement.
- Play a significant role in defining and leading PCU’s enterprise security strategy and roadmap, integrating hybrid cloud security, AI security and governance, data protection, and emerging technology risk to strengthen cyber resilience and protect critical information assets and services.
- Lead a continuous, risk-based security awareness and human risk management program that strengthens the organization’s security culture, drives measurable behavior change, and prepares employees to recognize and respond to evolving threats, including phishing, social engineering, deepfakes, and AI-enabled attacks.
- Lead a risk-based Vulnerability and Exposure Management program to continuously identify, prioritize, and remediate security vulnerabilities within established SLAs, driving accountability for overdue remediation, reducing the organization’s attack surface, and strengthening overall cyber resilience.
- Modernize Security Operations through AI, automation, threat intelligence, and advanced detection capabilities to accelerate threat identification, investigation, containment, and response. Lead enterprise security incident response and investigations.
- Provide strategic leadership for the Information Security GRC program, ensuring effective governance, regulatory compliance, third-party risk management, independent security assessments, penetration testing, and resilience exercises, with clear accountability for findings, remediation, risk acceptance, and executive reporting.
- Provide governance and oversight of security service providers to ensure continuous 24x7 coverage, clearly defined SLAs, escalation protocols, service quality, and alignment with PCU’s security objectives.
- Provide regular reporting on the current health of the information security program to leadership, including development of KPI’s, metrics and capability measurement against industry frameworks.
- Lead security risk assessments for internal projects and technology initiatives, ensuring assessments are completed in a timely manner, risks are identified and evaluated, and appropriate security controls are defined, implemented, and tracked through remediation.
- Lead security technology lifecycle and vendor management to ensure security platforms remain supported, appropriately configured, and aligned with evolving threats, while eliminating capability gaps and redundancies and maximizing return on security investment.
- Govern and maintain Information Security policies, standards, and guidelines to ensure alignment with evolving risks, regulatory requirements, and industry practices.
- Ensure the Information Security program is aligned with applicable regulatory requirements and industry-recognized cybersecurity frameworks, including NIST and NCUA guidance, to support effective risk management, regulatory compliance, and continuous improvement.
- Perform other Information Security leadership responsibilities and related duties as assigned.
Qualifications
QUALIFICATIONS
Education
- Bachelor's Degree in Computer Science or equivalent work or education-related experience.
Work Experience
- 15+ years of progressive Information Technology experience, including 8+ years in Information Security leadership, with experience building and maturing enterprise security engineering and operations programs across hybrid cloud environments and advancing capabilities in AI security and governance, automation, threat management, and emerging technologies.
Knowledge, Skills and Abilities
- Broad expertise across cloud security, AI security and governance, and emerging technologies, supported by experience implementing Zero Trust principles and NIST-based frameworks to guide security architecture, control design, risk management, and enterprise cyber resilience.
- Excellent written and verbal communication skills, interpersonal and collaborative skills effective in communicating security and risk-related concepts to technical and non-technical audiences.
- Knowledge and understanding of relevant legal and regulatory requirements such as NCUA, DFPI, Payment Card Industry (PCI) and Data Security Standards.
- Strong operational management skills including project management, financial/budget management, scheduling and resource management.
- Ability to consistently demonstrate good judgment and decision-making skills.
- Excellent leadership, people management and organizational development skills, with a demonstrated ability to motivate others in a team-oriented and collaborative environment.
Licenses and Certifications
- CISSP Certified Information Systems Security Professional
- CISM - Certified Information Security Manager
Benefits you will enjoy:
- Quality medical, dental and vision care coverage
- 401(k) retirement plan with up to 150% matching employer contributions
- Annual discretionary bonus
- Generous paid time off and paid holidays
- Flexible spending accounts
- Employee Referral Bonus
- Short and long-term disability coverage
- Life and AD&D insurance
- Provident membership
- Rate discount on home and auto loans
- Opportunity to use company owned condo in Maui and Lake Tahoe
Compensation:
Pay Grade is M4. This position is eligible for our twice-a-year discretionary bonus.
Targeted Base Pay: $155,000 - $202,000 (Depending on experience)
Provident is an Equal Opportunity Employer
We are the winner of the Bay Area News Group Top WorkPlace in 2017 - 2026. Check us out on Glassdoor
