Haberfeld Holdings

Information Security OfficerLocation: Lincoln, Nebraska (Hybrid: 3 Days/Week In Office)Company: HaberfeldEmployment Type: Full-Time | Employee-Owned (ESOP)Help Protect the Future of a Growing Employee-Owned CompanyAt Haberfeld, we help financial institutions grow through a powerful combination of consulting, marketing, analytics, data, and technology. As we continue expanding our use of cloud technologies, artificial intelligence, and data-driven solutions, security remains a top business priority.We're seeking an experienced and collaborative Information Security Officer to lead our information security program and help safeguard our people, systems, clients, and data. This role combines regulatory compliance, cybersecurity leadership, risk management, incident response, vendor oversight, and employee education into a highly visible position that works across every department of the organization.This is an exceptional opportunity for someone who enjoys building relationships, influencing positive security behaviors, and helping an organization achieve security excellence while supporting innovation and growth.What You'll DoIn this role, you will own and continually mature Haberfeld's information security program, ensuring security practices align with business objectives, regulatory requirements, and industry frameworks.Security Governance & Program LeadershipLead and maintain the enterprise Information Security Program.Develop, review, and update security policies, standards, procedures, and guidelines.Drive alignment with applicable security frameworks, including NIST Cybersecurity Framework, HIPAA, and SOC requirements.Present security risks, initiatives, and program updates to executive leadership and internal committees.Facilitate meetings and communications for the Information Security Team.Risk ManagementLead enterprise risk assessments and maintain the organization's risk register.Conduct and coordinate annual security assessments.Oversee vulnerability management activities and remediation efforts.Coordinate penetration testing, social engineering assessments, and tabletop exercises.Assess security implications of new technologies, cloud services, AI initiatives, and business projects.Compliance & Audit ManagementServe as the primary coordinator for annual SOC/SSAE18 audits and HIPAA assessments.Monitor compliance with internal policies and regulatory requirements.Coordinate collection and maintenance of audit evidence and documentation.Assist business stakeholders in meeting security and compliance obligations.Security Operations & Incident ResponseCoordinate detection, investigation, and response to security incidents.Maintain incident response plans and procedures.Document, track, and report security incidents and corrective actions.Lead post-incident reviews and recommend improvements.Assist with business continuity and disaster recovery planning activities.Vendor & Third-Party Risk ManagementPerform security reviews of vendors and service providers.Maintain third-party risk documentation and assessments.Review contracts and security requirements with prospective vendors.Track remediation efforts related to vendor security findings.Security Awareness & CultureDevelop and deliver ongoing security awareness training.Manage phishing simulations and social engineering programs.Promote a culture of security across all departments.Partner with Human Resources concerning security policy violations and corrective actions.Data Protection & PrivacyServe as HIPAA Security Officer and Privacy Officer.Support data classification, retention, and protection initiatives.Help ensure appropriate controls exist around confidential and sensitive information.Collaborate with business and technical teams to improve data governance practices.Cloud, Microsoft 365, and Emerging Technology SecurityPartner with IT leadership to strengthen Microsoft 365, Azure, endpoint, identity, and collaboration platform security.Review and assess security controls associated with AI, automation, and cloud services.Monitor evolving cybersecurity threats and recommend improvements to organizational defenses.Support implementation of security best practices for modern workplace technologies.What Success Looks LikeIn your first year, you will:Maintain successful SOC and HIPAA assessments.Improve security awareness and employee engagement.Advance Haberfeld's security maturity against NIST and industry best practices.Strengthen incident response and risk management processes.Enhance security governance around cloud and AI initiatives.Help protect the organization while enabling innovation and growth.QualificationsWe’re less focused on checking every box and more focused on finding someone who is curious, capable, and eager to grow.RequiredBachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Business, or related field.3+ years of experience in information security, cybersecurity, IT audit, compliance, risk management, or related disciplines.Experience developing or maintaining information security policies and procedures.Strong understanding of security frameworks such as NIST, HIPAA, and SOC.Experience conducting risk assessments and vendor evaluations.Strong communication, training, and presentation skills.Strong project management and organizational capabilities.Ability to communicate technical concepts to both technical and non-technical audiences.PreferredSecurity certifications such as CISSP, CISM, CRISC, Security+, HCISPP, CISA, or similar.Experience with Microsoft 365 Security, Microsoft Defender, Entra ID, Microsoft Purview, Sentinel, or Azure security services.Experience supporting compliance or audit programs.Experience with regulated industries such as healthcare, financial services, or data-driven organizations.Knowledge of privacy regulations and data governance principles.Experience evaluating AI security and governance risks.Why HaberfeldWe believe great people deserve great benefits and meaningful work. What We Offer:Competitive salary and incentive opportunitiesEmployee Stock Ownership Plan (ESOP)401(k)Medical, dental, and vision insuranceLife and disability insuranceResponsible Time Off (RTO)Paid pregnancy-related leavePaid parental bonding leaveNebraska Paid Sick leaveMilitary leaveBirthday holidayCompany holidaysFlexible hybrid work environmentOnsite fitness facilityWellness programsEducation benefitFree parkingSummer early-out FridaysEmployee Assistance Program (EAP)Financial planning resourcesAbout HaberfeldHaberfeld helps organizations achieve sustainable growth through a unique blend of consulting, analytics, training, technology, and marketing solutions. As an employee-owned company, we believe shared ownership leads to stronger commitment, better collaboration, and exceptional outcomes for our clients.Our core values guide everything we do:Integrity • Excellence • Collaboration • Curiosity • Joy in the JourneyJoin UsIf you’re excited to apply your expertise in a collaborative, employee‑owned environment, we’d love to hear from you.Apply today and help us build what’s next together. #J-18808-Ljbffr