Position Summary
Shoreham Bank is seeking an experienced Information Security & Cybersecurity Manager to lead and oversee the Bank's Information Security Program, cybersecurity operations, and technology risk management functions. This is a hands-on leadership role responsible for safeguarding the Bank's information assets, ensuring regulatory compliance, strengthening cyber resilience, and supporting the secure operation of the Bank's technology infrastructure.
The ideal candidate will possess a strong background in information security, cybersecurity governance, and enterprise infrastructure. Professional certifications such as CISSP, CISA, CISM, or equivalent are highly desirable.
Key Responsibilities
Cybersecurity, Governance & Compliance
- Lead and continuously enhance the Bank's cybersecurity and information security program.
- Own and improve the organization's security posture across identity and access management, endpoint protection, email security, patch management, vulnerability management, and security monitoring.
- Implement and maintain security controls including multi-factor authentication (MFA), conditional access, identity and access policies, secure application access, security logging, vulnerability assessments, and penetration testing remediation.
- Configure and maintain enterprise email security controls, secure mail flow policies, sender authentication, message filtering, impersonation protection, quarantine handling, and related user protection policies.
- Manage identity federation and secure authentication integrations, including single sign-on, SAML-based access, role-based permissions, and secure application onboarding.
- Oversee vulnerability scanning, risk-based prioritization, remediation tracking, and validation of corrective actions across systems, applications, and infrastructure.
- Coordinate patch management governance, including review of patch status, exception handling, maintenance planning, and escalation of overdue or high-risk updates.
- Develop, maintain, and enforce information security policies, standards, procedures, and governance frameworks.
- Partner with technology leadership to ensure the secure and successful execution of the Bank's technology initiatives.
- Monitor cybersecurity threats, review security alerts and log activity, and investigate suspicious events.
- Implement, tune, and manage detection logic across enterprise security monitoring, endpoint detection and response, extended detection and response, and cloud-native security platforms.
- Conduct risk assessments and identify vulnerabilities, patching gaps, and control weaknesses within systems, applications, and network infrastructure.
- Lead incident response efforts, including investigation, containment, recovery, post-incident analysis, threat hunting, and analysis of adversary tactics, techniques, and procedures.
- Develop and maintain cybersecurity awareness, secure technology adoption guidance, and practical training materials for employees.
- Ensure compliance with applicable regulatory requirements and industry standards, including FFIEC guidance and banking cybersecurity expectations.
- Oversee data protection, information governance, and secure data handling practices for sensitive customer, employee, and business information.
- Establish and enforce governance for emerging technologies, artificial intelligence tools, collaboration platforms, and automated workflows to ensure appropriate access, data protection, and regulatory alignment.
- Translate cybersecurity, privacy, and technology risk into clear business guidance for executive leadership, department managers, auditors, and end users.
- Support secure adoption of cloud services, third-party platforms, and digital business tools through risk review, access governance, and control validation.
Infrastructure & Systems Security Oversight
Provide security governance and oversight for:
- Windows and Linux (Debian, Red Hat) server environments
- Docker and containerized application platforms
- Active Directory, Microsoft Entra ID, and Microsoft 365 identity management
- Virtualization platforms including VMware ESXi, vSAN, and Proxmox
- Network infrastructure including SD-WAN, VLANs, wireless networks, Zero Trust Network Access (ZTNA), routing, switching, and firewall technologies (FortiGate and Aruba/HPE Networking)
- Backup, disaster recovery, and business continuity solutions, including Veeam
- Core banking and operational systems including Jack Henry SilverLake, LoanVantage, Encompass, and DecisionLender4
Data Protection, AI Governance & Secure Technology Enablement
- Develop and maintain governance practices for sensitive data classification, secure sharing, retention, access control, and protection of confidential information.
- Provide security oversight for artificial intelligence, automation, collaboration, and productivity capabilities to ensure they are used responsibly and in accordance with bank policy and regulatory expectations.
- Partner with business departments to evaluate new digital workflows, internal applications, and process automation initiatives for security, privacy, and access risks.
- Define practical guardrails for employee use of emerging technologies, including appropriate handling of customer information, business records, and regulated data.
- Coordinate with technology, compliance, operations, and business teams to ensure secure implementation of new platforms, integrations, and user-facing tools.
Regulatory Compliance & Audit Management
- Support internal audits, external audits, regulatory examinations, and cybersecurity assessments.
- Maintain comprehensive documentation of security controls, policies, standards, procedures, and risk assessments.
- Ensure technology operations and security controls comply with applicable regulatory and governance requirements.
- Support alignment with applicable privacy, information security, banking, and technology risk management requirements beyond cybersecurity-specific guidance.
- Coordinate audit and examination evidence collection and maintain remediation tracking for findings and recommendations.
- Track remediation of vulnerabilities, patching gaps, audit findings, and control exceptions through closure.
- Prepare clear risk summaries, control updates, and remediation status reporting for leadership, committees, auditors, and regulators as needed.
- Assist in the development and testing of business continuity, disaster recovery, and incident response plans.
Minimum Requirements
- Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field.
- Minimum of five years of progressive experience in information technology, cybersecurity, or information security leadership.
- Demonstrated experience leading or managing an enterprise information security program.
- Strong knowledge of cybersecurity frameworks, risk management principles, and security best practices.
- Excellent communication, leadership, and problem-solving skills.
- Experience working within a regulated financial services or banking environment is strongly preferred.
Preferred Qualifications
Education & Certifications
- Bachelor’s degree in Cybersecurity or related field (Master's degree preferred).
- One or more of the following certifications preferred:
- CISSP (Certified Information Systems Security Professional)
- CISA (Certified Information Systems Auditor)
- CISM (Certified Information Security Manager)
- CEH (Certified Ethical Hacker)
Technical Expertise
- Cybersecurity operations and threat management
- Identity and access management, including authentication policies, federation, SSO, SAML, role-based access, and secure application onboarding
- Email security policy management, secure mail flow, sender authentication, phishing protection, impersonation controls, message filtering, and quarantine administration
- Microsoft 365 Security and Azure Security
- Network security architecture and Zero Trust frameworks
- Cloud platforms including Azure, AWS, and Cloudflare
- Linux and Windows administration
- Docker and virtualization technologies
- Backup and disaster recovery solutions
- Security monitoring, incident response, and vulnerability management
- Deep technical knowledge of incident response, threat hunting, and adversary tactics, techniques, and procedures
- Experience implementing and managing detection logic across enterprise SIEM, EDR/XDR, or cloud-native security tools
- Patch management governance, vulnerability scanning, remediation validation, and exception tracking
- Data protection, information governance, and secure collaboration practices
- Artificial intelligence governance, secure automation, and emerging technology risk management
- Security review of third-party services, digital integrations, and cloud-based business platforms
- Enterprise collaboration and productivity platforms, including Microsoft Copilot
Work Environment
- Full-time, on-site position for normal daily activities mixed with offsite work for off-hours patching, maintenance, and vulnerability remediation.
- After-hours emergency availability may also be required to support cybersecurity alerts or incidents.
Equal Employment Opportunity
Shoreham Bank provides equal employment opportunities, without discrimination because of race, color, religion, creed, sex, sexual orientation, gender identity or expression, pregnancy, marital status, age, national origin, citizenship, handicap or disability, veteran or military status, political beliefs, victim of domestic violence status, familial status, or predisposing genetic characteristics or status, or any other status protected by federal, state, local or other law.
Job Type: Full-time
Pay: From $90,000.00 per year
Benefits:
- 401(k)
- 401(k) matching
- Dental insurance
- Employee assistance program
- Flexible spending account
- Health insurance
- Life insurance
- Paid time off
- Retirement plan
- Tuition reimbursement
- Vision insurance
Education:
Experience:
- information security: 5 years (Preferred)
- management: 1 year (Preferred)
Work Location: In person
