Cybersecurity Governance, Risk and Compliance Manager

Where It Began… In 1951 SF Fire Credit Union first opened its doors from a modest 10′ × 15′ office space in 17 Engine. It was from those humble beginnings—where everyone pitched in to help one another in their community—that the organization forged its way of business forever.
Today, the San Francisco-based credit union has grown to $1.7B in assets and a membership that extends from the regional firefighters we trace our roots back to throughout our many neighbors in San Francisco, San Mateo and Marin Counties. Our members benefit from the ideas and principles that have shaped us: Shared trust, continuous innovation of products and services, competitive rates, and excellent member service. These qualities foster a true sense of member-ownership and strengthen the credit union’s bond with the people for whom this credit union was created. What We Stand For… There are a few things we look for in those we hire at SF Fire Credit Union, regardless of role or team.
First, do they align with our values? 欄   Be Personal Walk the Member / Employee Path ⭐   Be a Leader Empower, Collaborate, Own    Be Outside the Box Innovate, Educate, Engage    Be Real Integrity and Transparency Matter    Be the Connection Serve our Community
Second, will they thrive in a culture like ours, where we default to trust, embrace feedback, and desire to innovate?
Finally, do they share our vision to help empower members to accomplish their dreams and build lasting financial security in whatever way is most relevant to their role? What It Feels Like… Most days it feels more like going to work with a big family.
Whether it’s a pot luck lunch, baking birthday cakes for colleagues in the kitchen, or after-hours get togethers, we’re here to do a great job and have a good time while doing it! We value a good sense of humor, are motivated by a higher purpose, and always bring an “in-this-together” attitude. While we’re driven to do great work, we also value real work/life balance. Is This the Career for You? SF Fire Credit Union is seeking a full-time Cybersecurity Governance, Risk and Compliance Manager to provide independent oversight of the Credit Union’s cybersecurity risk. Operating independently of the CIO and IT management reporting lines, this role reviews IT cybersecurity practices and control effectiveness, challenges decisions to defer remediation or accept risk, and ensures material cybersecurity issues reach the appropriate decision makers.
Success in this position requires deep cybersecurity expertise, sound judgment, and the ability to communicate clearly and challenge constructively across IT, Information Security, Compliance, Legal, and business leadership. What You Get To Do Independent Risk Assessment and Challenge
- Independently review IT cybersecurity practices, policies, configurations, procedures, and control effectiveness
- Assess whether IT’s response to emerging vulnerabilities, security advisories, and threat intelligence is timely and proportionate to the institutions risk exposure
- Recommend improvements to IT controls, processes, resource allocation, and remediation plans
- Challenge decisions to defer remediation or accept cybersecurity risks and require documented justification and appropriate risk acceptance
Cross-functional Coordination and Communication
- Establish expectations for sharing material cybersecurity information among IT, Information Security, Marketing, Compliance, Legal, Business Leadership, and affected functions
- Verify that relevant stakeholders are notified when a threat may affect the organization, its website, customer-facing systems, confidential information, or business operations
- Ensure that threat assessments and recommended actions are communicated to the appropriate decision makers, with clear ownership and deadlines
Oversight, Validation, and Escalation
- Independently monitor remediation of identified cybersecurity weaknesses and verify copletion of material corrective actions
- Maintain a risk-based register of significant cybersecurity issues, remediation commitments, overdue actions, and accepted risks
- Escalate material or overdue issues to the CRO and, when appropriate, the CEO or the appropriate board committee provide periodic reporting on cybersecurity risk exposure, control effectiveness, incident response, phishing trends, and outstanding remediation
Authority and Organizational Positioning The role should operate independently of the CIO and IT management reporting lines. It should have sufficient access to relevant systems documentation, policies, incident records, assessment results, and personnel to perform its oversight responsibilities.
The role should have the authority to request corrective action plans, challenge proposed remediation timelines, recommend additional safeguards, and escalate unresolved concerns without IT management approval.
Where a material risk requires immediate protective action, the role should be empowered to recommend urgent containment measures and invoke a defined escalation process. Any authority to direct or suspend technology operations should be explicitly established in the organization's governance framework, including clear decision rights, emergency procedures, and coordination requirements with the CIO and CRO.
The role should be appropriately resourced for the institution’s size and risk profile. The initial structure may be a dedicated Cybersecurity Governance, Risk and Compliance Manager or an appropriately qualified individual with a clearly defined mandate, provided the necessary independence, expertise, and authority are maintained. What We Look For In You Desired Qualifications:
- Bachelor’s degree in Information Security, Computer Science or related field, Advanced degree preferred
- Required 7+ years of progressive cybersecurity experience or related experience in IT, Compliance, or Audit
- CISSP, CCSP, CISM, GIAC, CISA, CRISC, or PCI-related certifications, including PCIP, ISA, or QSA
This job description describes the general nature and level of work expected of the position. Responsibilities may evolve as organizational needs and strategic priorities change. Salary This compensation range takes into account the wide range of factors considered in making compensation decisions, including but not limited to skill sets, experience and training, licensure and certifications, and other business and organizational needs. At SFFCU, it is not typical for an individual to be hired at or near the top of the range for their role, and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range for the San Francisco market is an annual base salary of  $144,800 to $217,000. OUR BENEFITS We have a competitive compensation and benefits package, but the true reward of working for SF Fire Credit Union goes beyond what you’ll see on a pay-stub. We genuinely care our employees and we strive to invest in their professional and personal growth. We’re a relatively small organization at about 200 employees, so you can see the impact of your efforts and the value your contributions bring to our members and fellow employees.
- 401(k) and Employer Match
- Health, Vision, Dental and Life Insurance
- Annual Incentive/Bonus Program
- Tuition Reimbursement Program
- 11 Paid Holidays + Competitive PTO package
- Home & Consumer Loan Program (Discounted Rates)
- Professional development and training programs
- On-demand personal coaching resource
- Wellness Program (Discounted Gym Membership)
“Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.”