Chief Information Security Officer (CISO)

At Credit Acceptance, we are building on the foundation of a successful business while investing in the future through technology, data, AI, and continuous improvement. As we continue to evolve, our Team Members play an active role in improving experiences, driving meaningful change, and shaping the future of our business. We foster an environment where people are empowered to contribute ideas, develop their careers, make an impact, and help lead our continued transformation.

Our Engineering teams are helping shape the future of Credit Acceptance through innovation. Team Members collaborate across the organization to solve complex challenges, build impactful solutions, challenge the status quo, and support informed business decisions. We value curiosity, continuous learning, and new ideas from people who are passionate about driving modernization and meaningful business impact.

Dealers and customers trust Credit Acceptance with their financial data. Regulators expect us to prove that trust is earned.

As the Vice President, Engineering - Security, Compliance and Trust (CISO), you will own how Credit Acceptance stays secure and compliant as we move to the cloud and put AI agents to work across the business. You will set the security strategy, lead the team that delivers it, and report on it to executive leadership and the Board. You are the company's designated CISO for regulatory purposes.

You report to the CTO and have direct access to the Audit Committee, including a private session at least once a year.

You will lead a team across security operations, security engineering (application, cloud, identity and AI security) and governance, risk and compliance. You will work closely with Engineering, Legal, Risk and Fraud so the secure path is also the fast path.

Agents are a new kind of actor in our environment. They have their own identities and make their own decisions. You will own the controls and evidence that let us adopt them quickly and keep the trust of our customers and regulators.

Hybrid from Southfield, MI; Bellevue, WA; or the San Francisco Bay Area.

Outcomes and Activities

Own the enterprise information security strategy, tied to business goals, regulatory requirements and Engineering's AI and modernization plans.

Own security for the move from on-premises data centers to AWS. Every workload lands in a secure, standard landing zone, and we modernize or retire legacy technology.

Lead vulnerability and exposure operations. Critical findings are fixed in hours, with AI-assisted prioritization and a person accountable for every decision.

Own identity and privileged access for people, services and agents.

Own data protection and privacy: classification, handling standards and controls on where sensitive data can go. Review privacy engineering with product and engineering teams so privacy-by-design holds across the product lifecycle, including how AI systems use and keep data.

Manage third-party and vendor cyber risk, from due diligence through ongoing monitoring, including security service providers, auditors and penetration testers. Any partner that builds or runs AI for us meets the same controls as our own teams.

Lead threat detection and incident response, including playbooks for compromised or misbehaving agents and executive tabletop exercises. Defend against AI-enabled attacks such as deepfake impersonation and synthetic identity fraud, with our fraud and operations teams.

Define how AI agents are secured, with Engineering's architecture and platform leaders. Each agent is a first-class identity with least-privilege access. Govern how agents call tools and data, including Model Context Protocol servers, and set policy for what an agent may decide and what stays with a person. Test AI systems and agents before release and continuously in production for prompt injection, tool misuse and data exfiltration. Every agent has an audit trail and can be suspended.

Keep a living inventory of AI systems, agents and the AI features inside the tools we buy, including unsanctioned use. Set acceptable-use, data-handling and third-party AI standards aligned to NIST AI RMF and ISO/IEC 42001.

Build security into how software is specified, generated, tested and deployed, including AI-assisted development. Automated gates replace manual reviews.

Lead compliance with the obligations of a public consumer lender: GLBA, NYDFS Part 500, SOX IT general controls, PCI DSS, state privacy laws and SEC cybersecurity disclosure. That includes audit and examiner response, and systems that produce evidence automatically, down to a record an examiner can follow of what an agent saw and what it changed.

Report to the Board: regular updates, the annual NYDFS Part 500 CISO report to the Board and the annual NYDFS certification, using a small set of metrics that drive decisions.

Lead the Company’s Information Security Compliance Committee, which meets at least quarterly with the Company’s Executive Leadership Team.

Build and develop the security team: hiring, developing people, building the skills to secure and use AI, and a security-aware culture across Engineering and the business.

Competencies

Customer Empathy: Customer Empathy is the ability to understand the perspectives, pain points, and experiences of customers. It involves actively putting oneself in the customer’s shoes, comprehending their needs and challenges, and using that understanding to provide a better, more customer-centric experience.

Engineering Excellence: Engineering Excellence is about bringing great craftsmanship and thought leadership to deliver an outstanding product that delights customers and solves for the business. This involves the pursuit and achievement of high standards, best practices, innovation, and superior solutions.

One Team: A One Team mindset refers to a collaborative approach across the organization, where individuals work together seamlessly, without boundaries, as a single, cohesive team. Shared goals, open communication and mutual support create a sense of collective purpose. This enables teams to navigate challenges and pursue shared objectives more effectively.

Owner’s Mindset: Owner’s Mindset involves adopting a set of behaviors that reflect a sense of responsibility, accountability, strategic thinking, and a proactive approach to managing your domain. As an owner, you understand the business and your domain(s) deeply and solve for the right outcome for the domain(s) and the business.

Requirements

Bachelor's degree (computer science or a related field preferred).

10+ years in information security, compliance or a related field.

10+ years leading an information security, compliance or risk team.

Regulatory compliance experience in financial services, such as GLBA, NYDFS Part 500, SOX and PCI DSS.

Experience leading business continuity and cyber incident response, including executive tabletop exercises and response to a significant incident.

Strong familiarity with NIST CSF, ISO 27001/27002 and SOC 2.

Strong knowledge of security architecture for cloud-native environments: identity and access management, encryption, network and endpoint controls and vulnerability management. Experience building security into CI/CD and software delivery.

Practical experience securing AI-enabled systems or AI-assisted development in production, including identity and access, data protection and testing.

Experience reporting security and risk to executive leadership and a Board.

Preferred

Master's degree.

Financial services, fintech or consumer lending experience.

AWS and Databricks security at production scale, including securing a migration from on-premises infrastructure.

Agentic AI in production: agent identity, governed tool access such as Model Context Protocol, runtime controls and agent-specific incident response.

AI-assisted detection, triage and response in a security operati