Head of Information Security

Job description

Calling all innovators – find your future at Fiserv. We’re Fiserv, a global leader in Fintech and payments, and we move money and information in a way that moves the world. We connect financial institutions, corporations, merchants, and consumers to one another millions of times a day – quickly, reliably, and securely. Any time you swipe your credit card, pay through a mobile app, or withdraw money from the bank, we’re involved. If you want to make an impact on a global scale, come make a difference at Fiserv. Job Title Head of Information Security Head of Information Security Company: MoneyPass Group (MPG) Function: Technology / Information Security Reports To: Chief Information Officer Location: Remote Level: Director / VP, depending on candidate experience Position Summary MoneyPass Group is seeking a hands-on Head of Information Security to establish and lead the company's information security, cyber risk, and security governance capabilities as MPG builds its independent technology environment. This leader will be responsible for defining MPG's security strategy, establishing an effective security control environment, managing cyber risk, and ensuring that security responsibilities are effectively executed across MPG and its technology partners. MPG operates a highly outsourced technology model in which managed service providers and other strategic partners deliver significant portions of infrastructure, application development, ATM technology, cloud, and security services. As a result, this role requires a leader who can effectively govern third-party security services while maintaining clear accountability for MPG's security posture. The successful candidate will combine security leadership, technical depth, risk management, compliance expertise, and strong vendor governance with the willingness to personally drive execution in a lean organization. Key Responsibilities Security Strategy & Governance Develop and maintain MPG's enterprise information security strategy, roadmap, policies, standards, and control framework aligned with the company's business objectives and risk tolerance. Establish security governance across MPG's corporate technology, payment and ATM environments, cloud services, software platforms, data platforms, and third-party technology ecosystem. Define security roles and responsibilities across MPG, its MSP/MSSP providers, software partners, and other critical vendors. Establish and maintain the company's cyber risk register and regularly communicate material risks, remediation priorities, and security posture to the CIO and executive leadership. Develop meaningful security metrics and executive reporting, including risk trends, vulnerabilities, incidents, control effectiveness, third-party risk, and remediation progress. Security Operations & Cyber Defense Provide oversight of MPG's security operations capabilities, including: Security monitoring and SIEM Managed detection and response (MDR) Endpoint detection and response (EDR) Vulnerability management Threat intelligence Identity monitoring Cloud security monitoring Email and collaboration security Security incident detection and response Manage and hold MPG's MSSP and other security providers accountable to defined SLAs, security requirements, escalation procedures, and performance metrics. Ensure vulnerabilities are appropriately identified, prioritized, assigned, remediated, and tracked through closure. Lead MPG's cyber incident response program, including incident response plans, escalation procedures, tabletop exercises, forensic coordination, regulatory/customer notification support, and post-incident reviews. Serve as MPG's primary security leader during significant cybersecurity incidents. Identity & Access Management Establish and oversee MPG's identity and access management program, including: Single sign-on and multifactor authentication Privileged access management Joiner/mover/leaver processes Role-based access Periodic access certification Service and privileged account governance Third-party access Segregation of duties Partner with IT and business leaders to implement appropriate least-privilege and Zero Trust principles across MPG's environment. Security Architecture & Engineering Establish security architecture principles and requirements for MPG's technology environment. Review material technology implementations and architecture changes for security risks and required controls. Partner with infrastructure, development, data, and MSP teams to incorporate security into cloud architecture, networks, endpoints, applications, APIs, integrations, and data platforms. Establish appropriate security practices throughout the software development lifecycle, including code scanning, dependency management, secrets management, application security testing, and remediation processes. Ensure new technologies—including AI and generative AI solutions—are evaluated for security, privacy, data protection, access, and third-party risks before production use. Risk, Compliance & Audit Own the technology security control environment supporting MPG's compliance and customer assurance requirements. Partner with Legal, Finance, Internal Audit, Compliance, and external auditors to establish and maintain readiness for applicable frameworks and requirements, including: SOC 1 SOC 2 PCI DSS, where applicable NIST Cybersecurity Framework CIS Controls Applicable customer, contractual, regulatory, and privacy requirements Translate compliance requirements into sustainable operational controls rather than point-in-time audit activities. Maintain appropriate evidence demonstrating control operation and effectiveness. Coordinate security-related audit activities and drive remediation of findings through closure. Third-Party & Supply Chain Security Establish MPG's third-party technology and cybersecurity risk management program. Define minimum security requirements for MSPs, MSSPs, SaaS providers, software development partners, data providers, and other critical vendors. Perform or oversee security assessments of critical vendors and review relevant SOC reports, penetration testing results, certifications, control exceptions, and remediation plans. Maintain clear MPG-versus-provider responsibility matrices for critical security controls. Ensure contracts contain appropriate cybersecurity, incident notification, data protection, audit, business continuity, and security-control requirements. Actively challenge providers rather than assuming outsourced technology means outsourced accountability. Data Protection Partner with MPG's data and technology teams to establish security controls governing sensitive corporate, customer, transaction, payment, and endpoint data. Establish standards for: Data classification Encryption Key management Data access Data retention and destruction Data loss prevention Secure data transfer Sensitive-data discovery and monitoring Work with the business to reduce unnecessary retention and exposure of sensitive information. Data Privacy & AI Governance Partner with Legal, Compliance, and business leaders to operationalize MPG's data privacy obligations, translating them into sustainable technical and operational controls, including applicable requirements under: Gramm-Leach-Bliley Act (GLBA), including the FTC Safeguards Rule and Privacy Rule requirements for protecting customer financial information California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable U.S. state privacy laws EU and UK General Data Protection Regulation (GDPR), where MPG processes personal data of individuals in those jurisdictions Maintain MPG's written information security program consistent with GLBA Safeguards Rule requirements, including periodic risk assessments, service provider oversight, and regular reporting to executive leadership and the Board. Support data inventories, data mapping, and records of processing, and conduct