Chief Information Security Officer

The Chief Information Security Officer (CISO) is responsible for establishing, leading, and continuously advancing CorServ’s information security and cybersecurity program. The CISO will own the company’s information security strategy, governance, risk management, security architecture, incident preparedness, and security compliance program. The role requires a hands-on approach to the implementation, operation, and continuous improvement of the technologies, controls, and processes required to protect the organization and its clients.

DUTIES AND RESPONSIBILITIES

• Establish a cybersecurity governance framework aligned with business objectives, regulatory requirements, client expectations, and industry best practices. 
• Establish security priorities and a security roadmap based on business risk, evolving technology requirements, and emerging threats; advise on risks, vulnerabilities, threats and recommended mitigation strategies.
• Lead enterprise cybersecurity risk assessments and ensure identified risks are appropriately documented, prioritized, remediated, or accepted. 
• Maintain a security program aligned with applicable frameworks and standards, including PCI DSS, SOC 2, and relevant banking and financial institution requirements. 
• Oversee activities required to maintain PCI and SOC compliance, including, but not limited to, security awareness training, weekly security scan reviews, and recurring monthly, quarterly, and annual compliance activities.
• Provide security leadership and oversight for regulatory examinations, client audits, penetration testing, vulnerability assessments, and third-party security reviews, and participate directly in the evaluation and remediation of significant findings. 
• Oversee security due diligence and third-party cybersecurity risk management, including responses to vendor and partner requests, as well as ongoing monitoring of critical vendors.
• Provide oversight of security architecture across applications, APIs, databases, networks, cloud environments, identity systems, endpoints, and third-party integrations. 
• Establish security architecture principles and standards supporting confidentiality, integrity, availability, resilience, and scalability. 
• Ensure effective operation of security technologies and controls including firewalls, intrusion detection and prevention, endpoint security, encryption, data loss prevention, file integrity monitoring, vulnerability management, and security monitoring. 
• Ensure effective identity and access management controls, including privileged access, authentication, authorization, MFA, and periodic access reviews. 
• Establish and oversee a comprehensive vulnerability management program across infrastructure, applications, endpoints, and other technology assets including internal and external scanning, penetration testing, remediation tracking, and risk-based prioritization. 
• Oversee security monitoring and detection capabilities designed to identify unauthorized activity, anomalous behavior, and emerging threats. 
• Partner with Technology, Network Operations, and Development teams to ensure vulnerabilities are remediated within established risk-based timelines. 
• Own the cybersecurity incident response program and ensure documented plans, roles, escalation procedures, and communication protocols are maintained and regularly tested. 
• Promote a security-conscious culture and ensure employees understand their responsibilities for protecting company and client information. 

REQUIRED SKILLS AND QUALIFICATIONS

• 10+ years of progressive experience in information security, cybersecurity, infrastructure security, security engineering, or related disciplines.
• Strong knowledge of cybersecurity governance, risk management, security architecture, incident response, vulnerability management, and security operations. 
• Deep understanding of NIST cybersecurity frameworks, PCI DSS, and SOC 2. 
• Hands-on experience with data protection, encryption, DLP, identity and access management, endpoint security, firewalls, intrusion detection/prevention, and security monitoring technologies. 
• Experience working with external auditors, regulators, financial institutions, clients, and third-party vendors on cybersecurity matters. 
• Ability to balance security requirements with business objectives and make risk-based decisions in a fast-paced technology environment. 
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, Engineering, or a related discipline. 
• Relevant professional certification such as CISSP, CISM, CRISC, CCSP.
• Ability to work within CorServ's footprint (AL, FL, GA, IA, KY, NE, NC, TN, TX, WI, WY)

About CorServ

CorServ is a credit card technology and portfolio management company that was founded in 2009. With decades of experience in payment systems, we enable financial institutions to enter or expand their credit card program with our open-source technology platform. Our global headquarters is in Atlanta, GA. We offer a competitive compensation package and company-paid benefits package including medical, dental, and vision. We also offer a generous PTO plan, 401k match, and the opportunity to work in a remote environment. 

CorServ is an Equal Opportunity employer—All qualified applicants/employees will receive consideration for employment without regard to that individual’s age, race, color, religion or creed, national origin or ancestry, sex (including pregnancy), sexual orientation, gender, gender identity, physical or mental disability, veteran status, genetic information, ethnicity, citizenship, or any other characteristic protected by law. CorServ is firmly committed to upholding EEO principles. As part of our standard pre-employment process, we conduct screenings for drugs, credit, and backgrounds in accordance with legal requirements and industry best practices. These measures help us maintain a safe, secure, and inclusive work environment for all employees.