Sr Business Information Security Officer

Sr Business Information Security Officer

The Sr Business Information Security Officer is Lennar Financial Services' senior information security and privacy risk leader, ensuring LFS's security program remains legally sound, defensible, and operationally effective across mortgage operations nationwide. Serving as the primary liaison between Legal, Compliance, the CISO, IT, and the business, this role translates regulatory, contractual, and litigation risk into practical, board-ready security controls. Partnering closely with LFS and enterprise security leadership, the VP owns the Written Information Security Program, leads regulatory and audit engagements, and delivers executive and board-level risk reporting. The role builds trusted, cross-functional partnerships while holding LFS accountable to Lennar's standards of quality, value, and integrity.

Your Responsibilities on the Team

• Own and continuously mature the LFS Written Information Security Program (WISP), supporting policies, and control framework, ensuring legal sufficiency and regulatory alignment.
• Define LFS-specific security standards and control baselines across origination, servicing, capital markets, and corporate functions in alignment with the enterprise security strategy.
• Lead the annual LFS security program review, including risk assessment and control gap analysis, and remediation roadmap, presenting findings to senior LFS and Enterprise leadership.
• Drive preparation and delivery of board and executive-level security risk materials, translating technical and regulatory complexity into clear, action-oriented narratives.
• Serve as the business and legal security subject matter expert in regulatory exams, audits, and investor reviews, owning response materials and corrective actions action plans.
• Interpret and operationalize GLBA, FFIEC, state privacy and cybersecurity laws, and investor security requirements across all LFS operations, partnering with Legal on litigation and enforcement exposure.
• Own the LFS information security risk register, providing independent challenge to security design decisions and escalating material risks through appropriate governance channels.
• Lead security incident governance, coordinating with the CISO, IT, and Legal on investigation, notification, and disclosure, and maintaining examination-ready documentation.
• Partner with Legal and Procurement to steer third-party security risk management, defining vendor review standards, and resolving unacceptable risk through governance channels.
• Champion team development and security awareness across LFS, providing leadership and mentorship to security risk Associates and driving required training completion.
• Contribute to enterprise security budget planning as the LFS subject matter lead, managing LFS-specific security spend and vendor relationships in coordination with enterprise leadership.

Your Toolbox

• Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, or Business Administration required; advanced degree (MBA, MS in Cybersecurity or Risk Management) preferred.
• 15+ years of progressive experience in information security, IT risk, regulatory compliance, or audit, including at least 5 years in a BISO or senior, business-facing security leadership role.
• Financial services or mortgage industry experience required; non-depository Mortgage lenders experience a significant differentiator.
• Proven track record leading security programs through regulatory examinations, investor audits, and incident response, including board-level reporting.
• Deep knowledge of GLBA Safeguards Rule, FFIEC guidance, state privacy and cybersecurity laws, and investor security requirements (FNMA, FHLMC, Ginnie Mae).
• Working fluency in NIST CSF/800-53, ISO 27001/27002, SOC 2, and FAIR quantitative risk analysis frameworks.
• Demonstrated ability to quantify cyber risk in financial terms and communicate it clearly to executives, Board members, and Legal leadership.
• Strong written and oral communication skills, with experience producing board-quality materials and executive risk briefings.
• CISSP, CISM, or CRISC certification required (at least two); CISA, CGRC, or ISO 27001 Lead Auditor preferred.
• Working knowledge of GRC platforms, SIEM tools, identity and access management, and third-party risk management systems.
• Discretion and sound judgment in handling sensitive consumer financial data and confidential regulatory matters.