Broomfield, Colorado, US (On-site)1 open job
Member-owned, not-for-profit credit union providing banking, lending, and digital banking services to about 200,000 member households across Kansas and Colorado.
Meritrust Credit Union is a member-owned, not-for-profit financial cooperative serving roughly 200,000 member households across Kansas and Colorado, with about $4 billion in assets under management and roots dating to 1935. Federally insured by the NCUA and formed in part through a merger with Premier Members Credit Union, it runs the full consumer and business stack: deposit accounts, credit cards, mortgages, personal and auto loans, business lending, and investment products. For security work, the interesting surface is the delivery channel - online, mobile, telephone, and virtual banking - because that's where member credentials, transaction data, and lending workflows actually live.
The threat model here is the one every credit union faces and few talk about precisely: account takeover against member-facing digital banking, payment and card fraud, wire and lending fraud, credential stuffing at the authentication layer, and third-party risk from the vendors behind those channels. A merger footprint adds its own drag - integrating environments, reconciling identity systems, and retiring legacy access paths without breaking service for members who expect round-up savings, early-payday access, and rewards features to just work. Regulated by NCUA, accountable to members rather than shareholders, and sized such that security work is unlikely to be abstract.
Technical domains run to digital banking, online banking, and mobile banking, which means the security problems are concrete: application and API security across web and mobile clients, fraud detection and transaction monitoring, IAM for members and staff, endpoint and network defense across branch and back-office infrastructure, and incident response that has to hold up under examination. Expect close coupling with fraud, compliance, core operations, and the teams shipping member-facing features - not a siloed security function, and not an environment where tooling choices are handed down from a distant platform org.
