Cybersecurity Governance, Risk and Compliance Manager

SF Fire Credit Union is seeking a full-time Cybersecurity Governance, Risk and Compliance Manager to deliver independent oversight of the organization’s cybersecurity risk. In this onsite role in San Francisco, CA, you will evaluate how IT security practices perform in real-world conditions, challenge remediation decisions when needed, and ensure material issues reach the right leaders with clear accountability.

This position is designed to operate with independence from the CIO and IT management reporting lines. You will review cybersecurity practices end-to-end, monitor remediation progress, and maintain a risk-based view of significant issues, accepted risks, and overdue commitments to support informed governance across the Credit Union.

Key Responsibilities

• Independently review IT cybersecurity practices, policies, configurations, procedures, and control effectiveness
• Assess whether IT responses to emerging vulnerabilities, security advisories, and threat intelligence are timely and proportionate to the Credit Union’s risk exposure
• Recommend improvements to IT controls, processes, resource allocation, and remediation plans
• Challenge decisions to defer remediation or accept cybersecurity risks, requiring documented justification and appropriate risk acceptance
• Establish expectations for sharing material cybersecurity information among IT, Information Security, Marketing, Compliance, Legal, Business Leadership, and affected functions
• Verify that relevant stakeholders are notified when a threat may affect the organization, its website, customer-facing systems, confidential information, or business operations
• Ensure threat assessments and recommended actions are communicated to appropriate decision makers with clear ownership and deadlines
• Independently monitor remediation of identified cybersecurity weaknesses and verify completion of material corrective actions
• Maintain a risk-based register of significant cybersecurity issues, remediation commitments, overdue actions, and accepted risks
• Escalate material or overdue issues to the CRO, and when appropriate, to the CEO or the appropriate board committee, including periodic reporting on cybersecurity risk exposure, control effectiveness, incident response, phishing trends, and outstanding remediation

Requirements

• Bachelor’s degree in Information Security, Computer Science, or a related field (advanced degree preferred)
• 7+ years of progressive cybersecurity experience, or related experience in IT, Compliance, or Audit
• Relevant certifications such as CISSP, CCSP, CISM, GIAC, CISA, CRISC, or PCI-related certifications including PCIP, ISA, or QSA

Authority and Organizational Positioning

• Operate independently of the CIO and IT management reporting lines
• Have sufficient access to relevant systems documentation, policies, incident records, assessment results, and personnel to perform oversight responsibilities
• Have authority to request corrective action plans, challenge proposed remediation timelines, recommend additional safeguards, and escalate unresolved concerns without IT management approval
• Be empowered to recommend urgent containment measures and invoke a defined escalation process when immediate protective action is required
• Have governance-defined authority regarding any direction or suspension of technology operations, including decision rights, emergency procedures, and coordination requirements with the CIO and CRO
• Be appropriately resourced for the institution’s size and risk profile

Compensation and Benefits

• Salary: USD 144,800 - 217,000 per year
• 401(k) and Employer Match
• Health, Vision, Dental and Life Insurance
• Annual Incentive/Bonus Program
• Tuition Reimbursement Program
• 11 Paid Holidays + competitive PTO package
• Home & Consumer Loan Program with discounted rates
• Professional development and training programs
• On-demand personal coaching resource
• Wellness Program with discounted gym membership