Chief Information Security Officer (CISO) at Credit… · Southfield

Chief Information Security Officer (CISO)

Location: Washington - Bellevue - Hybrid

At Credit Acceptance, we are building on the foundation of a successful business while investing in the future through technology, data, AI, and continuous improvement. As we continue to evolve, our Team Members play an active role in improving experiences, driving meaningful change, and shaping the future of our business. We foster an environment where people are empowered to contribute ideas, develop their careers, make an impact, and help lead our continued transformation.

Our Engineering teams are helping shape the future of Credit Acceptance through innovation. Team Members collaborate across the organization to solve complex challenges, build impactful solutions, challenge the status quo, and support informed business decisions. We value curiosity, continuous learning, and new ideas from people who are passionate about driving modernization and meaningful business impact.

Dealers and customers trust Credit Acceptance with their financial data. Regulators expect us to prove that trust is earned.

As the Vice President, Engineering - Security, Compliance and Trust (CISO), you will own how Credit Acceptance stays secure and compliant as we move to the cloud and put AI agents to work across the business. You will set the security strategy, lead the team that delivers it, and report on it to executive leadership and the Board. You are the company's designated CISO for regulatory purposes.

You report to the CTO and have direct access to the Audit Committee, including a private session at least once a year.

You will lead a team across security operations, security engineering (application, cloud, identity and AI security) and governance, risk and compliance. You will work closely with Engineering, Legal, Risk and Fraud so the secure path is also the fast path.

Agents are a new kind of actor in our environment. They have their own identities and make their own decisions. You will own the controls and evidence that let us adopt them quickly and keep the trust of our customers and regulators.

Hybrid from Southfield, MI; Bellevue, WA; or the San Francisco Bay Area.

Outcomes and Activities

• Own the enterprise information security strategy, tied to business goals, regulatory requirements and Engineering's AI and modernization plans.

• Own security for the move from on-premises data centers to AWS. Every workload lands in a secure, standard landing zone, and we modernize or retire legacy technology.

• Lead vulnerability and exposure operations. Critical findings are fixed in hours, with AI-assisted prioritization and a person accountable for every decision.

• Own identity and privileged access for people, services and agents.

• Own data protection and privacy: classification, handling standards and controls on where sensitive data can go. Review privacy engineering with product and engineering teams so privacy-by-design holds across the product lifecycle, including how AI systems use and keep data.

• Manage third-party and vendor cyber risk, from due diligence through ongoing monitoring, including security service providers, auditors and penetration testers. Any partner that builds or runs AI for us meets the same controls as our own teams.

• Lead threat detection and incident response, including playbooks for compromised or misbehaving agents and executive tabletop exercises. Defend against AI-enabled attacks such as deepfake impersonation and synthetic identity fraud, with our fraud and operations teams.

• Define how AI agents are secured, with Engineering's architecture and platform leaders. Each agent is a first-class identity with least-privilege access. Govern how agents call tools and data, including Model Context Protocol servers, and set policy for what an agent may decide and what stays with a person. Test AI systems and agents before release and continuously in production for prompt injection, tool misuse and data exfiltration. Every agent has an audit trail and can be suspended.

• Keep a living inventory of AI systems, agents and the AI features inside the tools we buy, including unsanctioned use. Set acceptable-use, data-handling and third-party AI standards aligned to NIST AI RMF and ISO/IEC 42001.

• Build security into how software is specified, generated, tested and deployed, including AI-assisted development. Automated gates replace manual reviews.

• Lead compliance with the obligations of a public consumer lender: GLBA, NYDFS Part 500, SOX IT general controls, PCI DSS, state privacy laws and SEC cybersecurity disclosure. That includes audit and examiner response, and systems that produce evidence automatically, down to a record an examiner can follow of what an agent saw and what it changed.

• Report to the Board: regular updates, the annual NYDFS Part 500 CISO report to the Board and the annual NYDFS certification, using a small set of metrics that drive decisions.

• Lead the Company’s Information Security Compliance Committee, which meets at least quarterly with the Company’s Executive Leadership Team.

• Build and develop the security team: hiring, developing people, building the skills to secure and use AI, and a security-aware culture across Engineering and the business.

Competencies

• Customer Empathy: Customer Empathy is the ability to understand the perspectives, pain points, and experiences of customers. It involves actively putting oneself in the customer’s shoes, comprehending their needs and challenges, and using that understanding to provide a better, more customer-centric experience.

• Engineering Excellence: Engineering Excellence is about bringing great craftsmanship and thought leadership to deliver an outstanding product that delights customers and solves for the business. This involves the pursuit and achievement of high standards, best practices, innovation, and superior solutions.

• One Team: A One Team mindset refers to a collaborative approach across the organization, where individuals work together seamlessly, without boundaries, as a single, cohesive team. Shared goals, open communication and mutual support create a sense of collective purpose. This enables teams to navigate challenges and pursue shared objectives more effectively.

• Owner’s Mindset: Owner’s Mindset involves adopting a set of behaviors that reflect a sense of responsibility, accountability, strategic thinking, and a proactive approach to managing your domain. As an owner, you understand the business and your domain(s) deeply and solve for the right outcome for the domain(s) and the business.

Requirements

• Bachelor's degree (computer science or a related field preferred).

• 10+ years in information security, compliance or a related field.

• 10+ years leading an information security, compliance or risk team.

• Regulatory compliance experience in financial services, such as GLBA, NYDFS Part 500, SOX and PCI DSS.

• Experience leading business continuity and cyber incident response, including executive tabletop exercises and response to a significant incident.

• Strong familiarity with NIST CSF, ISO 27001/27002 and SOC 2.

• Strong knowledge of security architecture for cloud-native environments: identity and access management, encryption, network and endpoint controls and vulnerability management. Experience building security into CI/CD and software delivery.

• Practical experience securing AI-enabled systems or AI-assisted development in production, including identity and access, data protection and testing.

• Experience reporting security and risk to executive leadership and a Board.

Preferred

• Master's degree.

• Financial services, fintech or consumer lending experience.

• AWS and Databricks security at production scale, including securing a migration from on-premises infrastructure.

• Agentic AI in production: agent identity, governed tool access such as Model Context Protocol, runtime controls and agent-specific incident response.

• AI-assisted detection, triage and response in a security operations center, with human oversight.

• SEC cybersecurity disclosure experience as the security leader of a public company.

• Risk assessment for AI systems and third-party AI vendors.

• CISSP, CISM or an equivalent security certification.

Knowledge and Skills

• Architecture: Ability to design security architecture that is built in by default and enforced through automation, not manual review.

• AI and Agent Security: Working knowledge of how agents are attacked and how they fail (prompt injection, tool misuse, identity and privilege abuse, memory poisoning) and the controls that contain them, drawing on the OWASP Top 10 for Agentic Applications, NIST AI RMF and ISO/IEC 42001.

• Risk Judgment: Ability to weigh security risk against business value, decide what an agent or a team may do on its own, and explain the tradeoff and the evidence plainly. Holds the higher bar and says so.

• Executive Communication: Ability to turn technical and AI risk into clear decisions for executives and the Board.

• Leadership and Influence: Ability to build a strong team, challenge the status quo, and earn trust across Engineering, Legal, Compliance, Risk and the business without relying on authority.

Target Compensation: This position offers a competitive base salary, with a range of $300,000 - $400,000.

This position is eligible for equity and annual cash bonuses.

Final compensation within the range is influenced by many factors including assigned hub location, role-specific skills, depth and experience level, industry background, relevant education and certifications.

This position follows a hybrid work model, offering two work-from-home days and three standard in-office days each week with the team and key stakeholders at a local office.

INDENGLP

#zip

#LI-Hybrid

Benefits

• Excellent benefits package that includes 401(K) match, adoption assistance, parental leave, tuition reimbursement, comprehensive medical/ dental/vision and many nonstandard benefits that make us a Great Place to Work

Our Company Values:

To be successful in this role, Team Members need to be:

• Positive by maintaining resiliency and focusing on solutions
• Respectful by collaborating and actively listening
• Insightful by cultivating innovation, accumulating business and role specific knowledge, demonstrating self-awareness and making quality decisions
• Direct by effectively communicating and conveying courage
• Earnest by taking accountability, applying feedback and effectively planning and priority setting

Expectations:

• Remain compliant with our policies processes and legal guidelines
• All other duties as assigned
• Attendance as required by department

Advice!

We understand that your career search may look different than others. Our hiring team wants to make sure that this would be a fit not just for us, but for you long term. If you are actively looking or starting to explore new opportunities, send us your application!

P.S.

We have great details around our stats, success, history and more. We’re proud of our culture and are happy to share why – let’s talk!

Required degrees must have been earned at institutions of Higher Education which are accredited by the Council for Higher Education Accreditation or equivalent.

Credit Acceptance is dedicated to providing an inclusive environment for all. We are proud to be an Equal Opportunity Employer and value a culturally diverse workforce. We believe in ensuring all team members demonstrate mutual respect for one another. All qualified applicants will receive consideration for employment without regard to protected characteristics like age, race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status.

California Residents: Please click here for the California Consumer Privacy Act (CCPA) notice regarding the personal information Credit Acceptance may collect from you.

Play the video below to learn more about our Company culture.