Chief Information Security Officer

Frankenmuth Insurance is seeking a hands-on, strategic Chief Information Security Officer to lead the continued evolution of our enterprise cybersecurity program. Reporting directly to the Chief Information Officer, this leader will have the opportunity to shape security strategy, strengthen risk-based governance and controls, and build a program that delivers measurable and sustained maturity improvements.

The ideal candidate is an experienced security program builder who can establish credibility with business and technology executives and the Board of Directors while remaining actively engaged in driving priorities. This role requires a leader who can translate cyber risk into clear business decisions, navigate regulatory expectations and audit findings, strengthen third-party risk and incident response capabilities, and develop a high-performing security team. Success will require a pragmatic, collaborative leader who can balance strategic direction with hands-on execution.

What You’ll Do

• Develops and executes a multi-year enterprise cybersecurity strategy and roadmap aligned with business objectives, enterprise risk appetite, applicable legal and regulatory requirements, and recognized frameworks such as the NIST Cybersecurity Framework.
• Leads the enterprise information security program across governance, risk identification, protection, detection, incident response, recovery, and continuous improvement.
• Establishes and maintains security policies, standards, control requirements, operating procedures, and exception processes; defines clear accountability for cybersecurity risk across the organization.
• Provides independent, risk-based advice to executive leadership and the Board, including regular reporting on material risks, threat trends, program maturity, regulatory readiness, control effectiveness, incidents, and investment priorities.
• Directs enterprise cybersecurity risk assessments, control evaluations, maturity assessments, and remediation planning; maintains an actionable view of current and emerging cyber risk.
• Oversees security architecture and engineering principles and ensures security is integrated into architecture, acquisition, software delivery, and change processes.
• Directs identity and access management, privileged access, vulnerability management, security monitoring, threat intelligence, penetration testing, data protection, and other core security capabilities.
• Establishes, tests, and continuously improves cybersecurity incident response and crisis management capabilities; coordinates investigations, containment, recovery, evidence preservation, communications, and regulatory or law-enforcement engagement with appropriate partners.
• Partners with business continuity, disaster recovery, and technology leaders to strengthen operational resiliency and validate recovery capabilities for critical services.
• Oversees third-party and supply-chain cybersecurity risk, including risk-tiering, due diligence, contract requirements, ongoing monitoring, issue escalation, and remediation.
• Leads cybersecurity compliance activities applicable to an insurer, including the information security program, risk assessments, service-provider oversight, incident response, required certifications, and regulatory examinations.
• Coordinates with Legal, Compliance, Privacy, Enterprise Risk Management, and Internal Audit to clarify ownership, monitor obligations, address findings, and maintain appropriate independence among management, oversight, and assurance activities.
• Develops and manages cybersecurity budgets, staffing plans, sourcing strategies, technology investments, and metrics; measures outcomes and prioritizes resources based on enterprise risk reduction and business value.
• Builds, leads, and develops a high-performing security organization; defines roles, decision rights, performance expectations, succession plans, and workforce development priorities.
• Establishes enterprise security awareness, role-based education, phishing resilience, and executive and Board education programs that promote shared accountability for protecting information.
• Monitors changes in the threat landscape, technology environment, insurance industry, and regulatory expectations; recommends timely changes to controls, priorities, and risk treatment.
• Serves as a trusted security advisor to business and technology leaders, enabling innovation and transformation while ensuring risks are understood, owned, and managed.

What You’ll Bring

• Significant experience leading or materially maturing a cybersecurity program in a mid-size highly regulated organization.
• A record of moving security practices toward repeatable controls, measurable outcomes, and sustained maturity improvement.
• Strong knowledge of risk governance, regulatory expectations, audit findings, third-party risk, incident response, and operational resilience.
• The ability to communicate complex cyber risks clearly to executives, the Board, regulators, auditors, and technical teams.
• A hands-on leadership style with the ability to set strategy, establish priorities, solve problems, and develop the team.
• Strong business judgment and the ability to balance risk reduction with operational needs, cost, and business objectives.
• Experience in insurance, financial services, or another regulated industry is strongly preferred.
• A bachelor’s degree and 10 or more years of progressive security, technology risk, or related experience.
• CISSP, CISM, CRISC, CISA, or a comparable certification is strongly preferred.