Information Security & Cybersecurity Manager

Shoreham Bank is seeking an experienced Information Security & Cybersecurity Manager to lead and oversee the Bank’s Information Security Program, cybersecurity operations, and technology risk management functions. This is a hands-on leadership role responsible for safeguarding the Bank’s information assets, ensuring regulatory compliance, strengthening cyber resilience, and supporting the secure operation of the Bank’s technology infrastructure., Cybersecurity, Governance & Compliance

• Lead and continuously enhance the Bank’s cybersecurity and information security program.
• Own and improve the organization’s security posture across identity and access management, endpoint protection, email security, patch management, vulnerability management, and security monitoring.
• Implement and maintain security controls including multi-factor authentication (MFA), conditional access, identity and access policies, secure application access, security logging, vulnerability assessments, and penetration testing remediation.
• Configure and maintain enterprise email security controls, secure mail flow policies, sender authentication, message filtering, impersonation protection, quarantine handling, and related user protection policies.
• Manage identity federation and secure authentication integrations, including single sign-on, SAML-based access, role-based permissions, and secure application onboarding.
• Oversee vulnerability scanning, risk-based prioritization, remediation tracking, and validation of corrective actions across systems, applications, and infrastructure.
• Coordinate patch management governance, including review of patch status, exception handling, maintenance planning, and escalation of overdue or high-risk updates.
• Develop, maintain, and enforce information security policies, standards, procedures, and governance frameworks.
• Partner with technology leadership to ensure the secure and successful execution of the Bank’s technology initiatives.
• Monitor cybersecurity threats, review security alerts and log activity, and investigate suspicious events.
• Implement, tune, and manage detection logic across enterprise security monitoring, endpoint detection and response, extended detection and response, and cloud-native security platforms.
• Conduct risk assessments and identify vulnerabilities, patching gaps, and control weaknesses within systems, applications, and network infrastructure.
• Lead incident response efforts, including investigation, containment, recovery, post-incident analysis, threat hunting, and analysis of adversary tactics, techniques, and procedures.
• Develop and maintain cybersecurity awareness, secure technology adoption guidance, and practical training materials for employees.
• Ensure compliance with applicable regulatory requirements and industry standards, including FFIEC guidance and banking cybersecurity expectations.
• Oversee data protection, information governance, and secure data handling practices for sensitive customer, employee, and business information.
• Establish and enforce governance for emerging technologies, artificial intelligence tools, collaboration platforms, and automated workflows to ensure appropriate access, data protection, and regulatory alignment.
• Translate cybersecurity, privacy, and technology risk into clear business guidance for executive leadership, department managers, auditors, and end users.
• Support secure adoption of cloud services, third-party platforms, and digital business tools through risk review, access governance, and control validation.

Infrastructure & Systems Security Oversight

Provide security governance and oversight for:

• Windows and Linux (Debian, Red Hat) server environments
• Docker and containerized application platforms
• Active Directory, Microsoft Entra ID, and Microsoft 365 identity management
• Virtualization platforms including VMware ESXi, vSAN, and Proxmox
• Network infrastructure including SD-WAN, VLANs, wireless networks, Zero Trust Network Access (ZTNA), routing, switching, and firewall technologies (FortiGate and Aruba/HPE Networking)
• Backup, disaster recovery, and business continuity solutions, including Veeam
• Core banking and operational systems including Jack Henry SilverLake, LoanVantage, Encompass, and DecisionLender4

Data Protection, AI Governance & Secure Technology Enablement

• Develop and maintain governance practices for sensitive data classification, secure sharing, retention, access control, and protection of confidential information.
• Provide security oversight for artificial intelligence, automation, collaboration, and productivity capabilities to ensure they are used responsibly and in accordance with bank policy and regulatory expectations.
• Partner with business departments to evaluate new digital workflows, internal applications, and process automation initiatives for security, privacy, and access risks.
• Define practical guardrails for employee use of emerging technologies, including appropriate handling of customer information, business records, and regulated data.
• Coordinate with technology, compliance, operations, and business teams to ensure secure implementation of new platforms, integrations, and user-facing tools.

Regulatory Compliance & Audit Management

• Support internal audits, external audits, regulatory examinations, and cybersecurity assessments.
• Maintain comprehensive documentation of security controls, policies, standards, procedures, and risk assessments.
• Ensure technology operations and security controls comply with applicable regulatory and governance requirements.
• Support alignment with applicable privacy, information security, banking, and technology risk management requirements beyond cybersecurity-specific guidance.
• Coordinate audit and examination evidence collection and maintain remediation tracking for findings and recommendations.
• Track remediation of vulnerabilities, patching gaps, audit findings, and control exceptions through closure.
• Prepare clear risk summaries, control updates, and remediation status reporting for leadership, committees, auditors, and regulators as needed.
• Assist in the development and testing of business continuity, disaster recovery, and incident response plans., * Identity and access management, including authentication policies, federation, SSO, SAML, role-based access, and secure application onboarding
• Email security policy management, secure mail flow, sender authentication, phishing protection, impersonation controls, message filtering, and quarantine administration
• Microsoft 365 Security and Azure Security
• Network security architecture and Zero Trust frameworks
• Cloud platforms including Azure, AWS, and Cloudflare
• Linux and Windows administration
• Docker and virtualization technologies
• Backup and disaster recovery solutions
• Security monitoring, incident response, and vulnerability management
• Deep technical knowledge of incident response, threat hunting, and adversary tactics, techniques, and procedures
• Experience implementing and managing detection logic across enterprise SIEM, EDR/XDR, or cloud-native security tools
• Patch management governance, vulnerability scanning, remediation validation, and exception tracking
• Data protection, information governance, and secure collaboration practices
• Artificial intelligence governance, secure automation, and emerging technology risk management
• Security review of third-party services, digital integrations, and cloud-based business platforms
• Enterprise collaboration and productivity platforms, including Microsoft Copilot

Work Environment

• Full-time, on-site position for normal daily activities mixed with offsite work for off-hours patching, maintenance, and vulnerability remediation.
• After-hours emergency availability may also be required to support cybersecurity alerts or incidents.

The ideal candidate will possess a strong background in information security, cybersecurity governance, and enterprise infrastructure. Professional certifications such as CISSP, CISA, CISM, or equivalent are highly desirable., * Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field.

• Minimum of five years of progressive experience in information technology, cybersecurity, or information security leadership.
• Demonstrated experience leading or managing an enterprise information security program.
• Strong knowledge of cybersecurity frameworks, risk management principles, and security best practices.
• Excellent communication, leadership, and problem-solving skills.
• Experience working within a regulated financial services or banking environment is strongly preferred.

Preferred Qualifications

Education & Certifications

• Bachelor’s degree in Cybersecurity or related field (Master’s degree preferred).
• One or more of the following certifications preferred:
• CISSP (Certified Information Systems Security Professional)
• CISA (Certified Information Systems Auditor)
• CISM (Certified Information Security Manager)
• CEH (Certified Ethical Hacker), * Bachelor’s (Preferred)

Experience:

• information security: 5 years (Preferred)
• management: 1 year (Preferred)

Pulled from the full job description

• Tuition reimbursement
• 401(k)
• Health insurance
• Retirement plan
• 401(k) matching
• Paid time off
• Vision insurance, * 401(k)
• 401(k) matching
• Dental insurance
• Employee assistance program
• Flexible spending account
• Health insurance
• Life insurance
• Paid time off
• Retirement plan
• Tuition reimbursement
• Vision insurance