AVP First Line of Defense Transformation

AVP First Line of Defense Transformation

Join to apply for the AVP First Line of Defense Transformation role at Four Leaf Federal Credit Union
.

It Starts With Our Employees

Four Leaf's ultimate goal is to provide the best-in-class member and employee experience, and it all begins with two things: hiring incredible people and giving them a great place to work.

The AVP First Line of Defense (FLOD) Transformation serves as the primary First Line of Defense resource for the Transformation Office, which includes Cyber Security, Information Technology, Digital Transformation, Value Realization (PMO), Business Systems Analysis (BSAS), and Business Intelligence (BI). The AVP FLOD Transformation acts as the operating liaison with our Back‑office and Technology CUSOs (Credit Union Service Organizations) in coordinating risk, compliance, audit, regulatory, and control initiatives.

This role will represent the Transformation Office as part of the Four Leaf First Line of Defense team with an indirect reporting line into the Chief Legal and Risk Officer.

• Strategic Liaison and Relationship Management:
  Act as the operating liaison for the Transformation Office to S3 (Back‑Office CUSO) and OTS (Technology CUSO) departments including but not limited to the PMO, Innovation, and Online Banking Digital Support and OTS Operations, Technical Services, Application Management and Innovations, working with these areas to coordinate risk, compliance, audit, regulatory, and control initiatives. Establish strong working relationships with S3/OTS directors, while providing oversight and support.
• Policy & Procedure Governance:
  Collaborate with relevant CUSO departments to ensure that all supporting policies and procedures are documented, adhered to, and fully aligned with Four Leaf’s policies and requirements.
• Risk Monitoring & Reporting:
  Identify key metrics (KRI’s) for monitoring current and emerging Technology, Cyber and Information Security risk. Monitor, measure and track risk indicators for exposure, working with the Transformation team to ensure recommendations, controls and mitigation steps are appropriately documented. Modify the KRI’s as KCI’s and KPI’s are updated.
• Audits, Examination & Risk Management Support:
  Manage and participate in audits, audit requests, exam requests, process mapping, risk assessments, model validation, risk appetite (key risk indicators), risk reporting, and compliance testing requests for the Transformation Office. Ensure adherence to applicable regulatory frameworks including: NCUA Part 748 (Security Program, Suspicious Activity Reports), NIST CSF, NYDFS 500, GLBA, PCI‑DSS, and other relevant data security laws. Serve as the primary Risk liaison for all internal and external audits or examinations pertaining to Technology and Information Security Risk, coordinating responses and remediation efforts.
• Quality Assurance and Control Testing for Transformation Office:
  Oversee internal control testing programs for control design and operational effectiveness. Ensure key controls are tested regularly and remediation efforts are tracked to completion.
• Business Continuity & Disaster Recovery Guidance:
  Provide technical guidance for Business Continuity and Disaster Recovery Plans (BCP/DR) for critical IT systems and applications, ensuring timely and effective recovery in the event of an outage or disaster.
• Reportable Events Management:
  Manage reportable events (issues incidents, and losses) and member complaints for the Transformation Office, including self‑reporting, root cause analysis, action planning, resolution, dashboarding, and documentation.
• Collaboration with Leadership:
  Facilitate collaboration with the first, second and third lines of defense functions under the guidance of the SVP Information and Cyber Security & Chief Legal & Risk Officer.
• Representation &
  
  Collaboration:
  
  Represent Transformation Office in various oversight committees, taskforces, and working groups; including but not limited to the Three Lines of Defense Working Group, Reportable Events Review Meeting, Enterprise Risk Management Committee (non‑voting member), as well as Four Leaf and Consortium…