Full-time CISO, Alerus

WHO ARE WE: Alerus is a commercial wealth bank and national retirement provider

with one core purpose: helping clients achieve their financial goals. We are

driven by a shared commitment to always do the right thing; leading with

integrity and providing valued advice and guidance to our clients. We value the

expertise and skillsets each team member provides and encourage collaboration,

innovation, adaptability, and an entrepreneurial spirit at all levels of our

company. By consistently seeking improvements and growth, we foster long-term

relationships with clients and team members. We are proud to be recognized as a

Top Workplace by numerous industry and regional outlets.

CORE VALUES:  Passion for Excellence :: Success is Never Final :: Do the Right

02Thing :: One Alerus

• ABOUT THE ROLE:
• The Vice President, Chief Information Security Officer (CISO) is the senior
• executive responsible for establishing, leading, and continuously maturing the
• organization’s enterprise‑wide information security strategy reporting directly

to the Chief Risk Officer. This role oversees the development, implementation,

and governance of security policies, programs, and technologies designed to

protect the confidentiality, integrity, and availability of customer, employee,

and institutional data across all lines of business. The CISO operates closely

with senior leadership, technology teams, risk functions, and business units to

ensure security is embedded into organizational strategy, operations, and

culture.  The CISO will be a part of IT Management to ensure the Company’s

technology environment matures and evolves to mitigate current and future

information security risks.  This position serves as the primary resource for

cybersecurity to executive management, the Board of Directors, and bank

regulators, and acts as a trusted advisor on emerging cyber threats, technology

risk, and digital resilience.

WHAT YOU'LL BE DOING:

• Develop, implement, and continuously update the company’s multi-year
• information security strategy, roadmap, and operating plan consistent with
• business objectives and risk appetite; define measurable outcomes and
• security program maturity targets.
• Establish and maintain information security policies, standards, and
• procedures aligned with applicable banking laws and regulations and
• recognized frameworks, including FFIEC guidance, the NIST Cybersecurity
• Framework, and CIS Controls.
• Ensure systems compliance with security policies, standards, and practices.
• Recommend and direct the implementation of solutions for non-compliant
• systems.
• Establish enterprise security architecture requirements across cloud,
• on-premises, third-party, and hybrid environments; conduct or approve
• security design reviews for material technology changes.
• Monitor the evolving threat and regulatory environment, including risks
• arising from cloud, artificial intelligence, and digital banking
• technologies; adjust strategy, controls, and resourcing accordingly and
• advise cross functional leadership on impacts to the company.
• Direct vulnerability management, penetration testing, attack-surface
• management, and remediation governance, including risk-based prioritization
• and escalation of overdue critical issues.
• Direct security operations, threat intelligence, threat hunting, monitoring,
• detection, and response activities, including the effective oversight of
• managed security service providers.
• Own, maintain, and regularly test the company’s Computer Security Incident
• Response Plan through tabletop exercises and simulations; serve as executive
• incident commander for material events and coordinate containment, recovery,
• communications, regulatory notifications, and post-incident reviews with
• Legal, Compliance, Fraud, Risk, and business leaders.
• Lead and advise on control framework for identity and access management, data
• classification, encryption, data loss prevention, endpoint and network
• security, cloud security, application security, and secure software
• development and DevSecOps control frameworks.
• Lead enterprise cybersecurity risk assessments and security program maturity
• assessments; identify critical systems, data, and business services and
• verify that risk treatment plans and controls provide appropriate protection.
• Own the information security budget, workforce plan, and external service
• strategy; work with IT leadership team and business leaders to prioritize
• investments based on risk reduction, business impact, regulatory
• expectations, and sound financial analysis.
• Lead cybersecurity oversight across the third-party lifecycle, including due
• diligence, contract security requirements, ongoing monitoring, concentration
• and supply-chain risk, issue remediation, and secure termination.
• Serve as the primary cybersecurity subject matter expert and point of contact
• for internal and external audits and regulatory examinations; coordinate
• responses to findings, corrective action plans, and remediation timelines
• with Internal Audit and external auditors and examiners.
• Partner with Business Continuity, Technology, Operations, and Risk to
• establish and regularly test cyber recovery, disaster recovery, and
• operational resilience plans for critical business services and technology
• dependencies.
• Collaborate with Legal and Compliance to ensure ongoing compliance with GLBA
• Section 501(b) and related Interagency Guidelines, PCI DSS, Sarbanes-Oxley
• requirements, and applicable state privacy and breach-notification laws.
• Maintain documentation and evidence necessary to demonstrate control design
• and operating effectiveness during regulatory reviews, audits, client due
• diligence, and cyber insurance underwriting.
• Partner with Enterprise Risk to develop, validate, and report key risk
• indicators, key performance indicators, control effectiveness, program
• maturity, material issues, and remediation aging to the Enterprise Risk
• Management Committee and Risk Committee.
• Partner with Risk to ensure cyber risk is appropriately incorporated into the
• Bank's overall risk appetite statement and ERM framework.
• Present quarterly, or more frequently as needed, to the Board Risk Committee
• on cybersecurity risk posture, program effectiveness and maturity, roadmap
• progress, emerging threats, material incidents, regulatory posture, and
• investment priorities.
• Provide clear, board-appropriate cybersecurity risk reporting and translate
• technical risk into business impact for non-technical stakeholders.
• Design and oversee an enterprise security awareness and role-based training
• program, including phishing simulations and effectiveness measures that
• reflect current threats and employee responsibilities.
• Build, lead, and develop a high-performing information security team,
• including succession planning and staff development.
• Partner with Data, Technology, Legal, Compliance, and Risk leaders to
• establish security requirements and governance for artificial intelligence
• systems and third-party AI tools, including data use, access, monitoring, and
• incident response.
• Other duties as assigned.
• WHAT YOU SHOULD HAVE:
• Bachelor’s degree in computer science, cybersecurity, management information
• systems, or a related field, or an equivalent combination of education and
• relevant experience.
• 10+ years of progressive information security experience, with at least 5
• years in a leadership role.
• Demonstrated experience building and maturing an enterprise information
• security program in a regulated financial institution or comparably regulated
• environment.
• Executive-level communication and influence skills, including experience
• translating technical risk into business impact for executive leadership,
• board committees, regulators, and non-technical stakeholders.
• Experience leading enterprise cyber risk assessments, security architecture,
• vulnerability management, penetration testing, remediation governance, and
• control-effectiveness testing.
• Experience with developing and providing an information security awareness
• and training program.
• Experience with developing and maintaining information security policies and
• standards.
• Demonstrated command of the NIST Cybersecurity Framework, FFIEC IT
• Examination Handbook guidance, CIS Controls, and banking regulatory
• expectations; working knowledge of ISO 27001 and SOC 2.
• Practical technical depth in cloud and hybrid architecture, network and
• endpoint security, identity and access management, encryption, data
• protection, application security, and secure software development.
• Knowledge of GLBA Section 501(b), related Interagency Guidelines, PCI DSS,
• Sarbanes-Oxley requirements, state privacy and breach-notification laws, and
• relevant federal and state banking regulatory expectations.
• Current Certified Information Systems Security Professional certification;
• CISM, CISA, CRISC, or CCSP certification preferred.
• PREFERRED ATTRIBUTES:
• Experience leading information security within banking, wealth management,
• retirement services, payments, or another regulated financial services
• organization.
• Experience with banking regulatory examinations, audit remediation, and
• executive and board reporting.
• Hands-on leadership experience in cloud security, secure architecture,
• DevSecOps, and technology transformation.
• High ethical standards, sound judgment under pressure, and a strong
• commitment to protecting clients and the company.
• Experience building security teams and effectively managing co-sourced
• security capabilities, managed security service providers, and specialized
• consultants.
• WHAT WE BRING TO THE TABLE:
• Competitive compensation including base salary, bonus and/or incentive
• opportunities.
• Comprehensive benefits package providing a wide range of health and
• well-being benefits, including medical, dental, vision, life and long-term
• disability insurance; and 401(k) and ESOP for retirement savings.
• Generous paid time off programs such as flexible time off, company-paid
• holidays, parental and bereavement leave.
• Learning and development resources for personal and professional career
• development, and advancement opportunities.
• Access to financial experts for guidance, financial wellness tools, and
• discounts on Alerus products and services.
• Support for the communities we live in through paid volunteer time and a
• company donation match opportunity.

WORK ENVIRONMENT: Work is typically performed in an office setting. The employee

is regularly required to sit for extended periods of time. The employee is

occasionally required to move about the office utilizing proper ergonomic

safeguards when doing so. Additionally, the employee must occasionally lift or

move supplies and materials up to 20 pounds.

BASE PAY RANGE:

03$200,000 - $250,000 annually

• The above information in this description has been designed to indicate the

general nature and level of work performed by employees in this position. It is

not designed to contain or be interpreted as an exhaustive list of all

responsibilities, duties, and qualifications required of employees assigned to

this job.

Alerus is an equal opportunity employer and value diversity at our company. We

do not discriminate on the basis of race, religion, color, national origin,

gender, sexual orientation, age, marital status, veteran status, or disability

status.