Security by Design: How Ally Financial’s CISO Builds Resiliency Into the Cloud

0:00We don't want security to be an afterthought. We want it to be baked in by design. And doing so requires that my team be partnered hand-in-hand with our engineers and the folks delivering solutions.

0:14Peter High: Welcome to Tech Innovation. I'm Peter High, president of Metastrategy. My guest today is Spencer Cremers. Spencer is the chief information security officer of Ally Financial. Ally is a leading digital financial services company that operates the nation's largest all-digital bank. as well as major auto finance, insurance, investing, and corporate finance businesses. The company serves roughly 9.5 million customers and has nearly$200 billion in assets under management. As the Chief Information Security Officer, Spencer leads Ally's information protection, cybersecurity, and technology risk management efforts helping safeguard the systems and information on which its customers and businesses rely.

0:53Peter High: Spencer joined Ally 20 years ago and has held several senior technology leadership positions across the company. including as Ally's interim chief information and data officer. He served as CIO of multiple divisions of the bank previously as well. In this conversation, Spencer and I will discuss how Ally's all-digital model shapes its approach to cybersecurity and resilience, what he learned from occupying both the CIDO and CISO seats, and how cloud adoption and artificial intelligence are changing the company's threat model. We'll also explore how Ally prepares for cyber incidents, enables responsible experimentation with AI, and sustains customer trust in an increasingly complex digital environment.

1:34Peter High: Today's episode is brought to you by Tynes 3B. Organizations are pushing teams to move faster with AI, but that's creating a wave of AI-generated code and unsanctioned automations, leading to rising costs, security risks, and huge IT burdens. Meet Tynes 3B, a single, secure environment that enables employees to build with AI while giving IT and security complete control to run and govern that work. 3B enables effortless building. Describe what you need in plain English, and 3B builds a fully functioning workflow. It uses IT-authorized connectors, meaning credentials, state-protected, and non-technical teams can innovate without taking on unseen risk.

2:09Peter High: Also, with full visibility across every workflow, IT gets total governance, while features like Auto-Tune and Auto-Fix ensure workflows improve and self-heal continuously over time. Employees get the freedom to build, while IT gets the control to govern. No shadow AI, no data leaks. Tines 3B moves IT and security from blockers to enablers, giving teams the speed to innovate without compromising control. Visit the Tines website at tines.com. That's T-I-N-E-S.com to learn more and try 3B for yourself. And now on to the interview. Spencer Kramers, welcome to Technovation. It's great to speak with you today.

2:46Yeah, thank you, Peter. Happy to be here.

2:48Peter High: Spencer, I thought we'd begin with Ally Financial. Fascinating organization. um talk a bit more about the company that you are a part of if you would so ally is uh one of the leading auto finance providers in the united states and we're also one of the largest digital only banks we have a fairly focused mission uh at really excelling at those two key parts of our business uh and of course as a digital bank uh we're very focused on delivering premier digital experiences for our customers that are centered on trust, accessibility, and just ease of doing business. And talk a bit about defining digital only.

3:32Peter High: It's a fascinating thing, obviously, to be able to say that you are that and that you are, of course, at scale. Talk a bit further about what that entails, if you would, for the uninitiated. Yeah, we like to think of ourselves as kind of one of the original fintech disruptors. When we launched our bank, we had this notion that in the current age, branches aren't necessarily critical to delivering services to customers. And so we wanted to be present and available to our customers kind of where they are and wherever they may be. So we launched with that concerted focus on being exclusively digital.

4:08And again, simple, easy to work with, and transparent in the ways in which we interact with our customers. So of course, technology is critical to everything we do with that digital focus. And it's also important that we constantly reinvent ourselves and continue to evolve our capabilities as customers' expectations evolve and change.

4:32Peter High: And talk a bit about your role as Chief Information Security Officer, if you would. What's within your purview? So I have responsibility for cybersecurity, which includes cyber defenses, cyber response, resiliency across kind of all aspects of our technology stack. And then I also have responsibility for technology risk management for the whole technology organization. And that's an important combination. We designed our cybersecurity organization intentionally that way to bring those two components together because we believe they're so integral to one another. Having responsibility for cybersecurity and risk management ensures that we design security in from the start and that as we think about our risk and control environment, it's tightly integrated with the actual physical implementation of our cybersecurity.

5:27Peter High: You mentioned earlier that the bank has the goal of delivering premier digital experiences for customers centered on trust. The connection certainly between trust and cybersecurity is a pretty straight line, but I'd love to have you kind of describe the role you feel your team plays in delivering that premier digital experience for customers centered on trust. Yeah, so as I've stepped into this role as CISO, it's been important for me that we're highly integrated with the rest of the technology organization and also with the business more broadly. We don't want security to be an afterthought. We want it to be baked in by design.

6:06And doing so requires that my team be partnered, you know, hand in hand with our engineers and the folks delivering solutions. So if we can build it in by design, build it in from the start, it really helps to promote that sort of trust experience with our customers. We take the protection of their data and the protection of their experiences with us very seriously. And so it's important that everyone across technology have ownership of that.

6:34Peter High: Ally doesn't have physical branches. And as you noted, therefore, technology is the principal point of interaction with your customers. I wonder, does the fact that that's the case make things a little bit less complex? Does it make the job, I don't want to say easier, of course, that's not the right framing, but I would imagine that having a single channel at least focuses the team a little bit differently than perhaps some of your peers across financial services. Yeah, I think that's right. The combination of that digital focus and then also our very focused business strategy does give us clarity of the mission and kind of clarity of where we need to focus our efforts.

7:13Certainly, that scale that we operate at and that focused business also means that we're able to promote a lot of enterprise platforms and shared solutions across our lines of business. We don't have a global footprint. We don't have dozens of business lines. We're more focused in our delivery and in the channels that we offer. And so that makes it easier for us to have common platforms. And of course, I prefer that because then we can ensure that we've got the right, again, kind of resiliency and security baked into those common platforms.

7:49Peter High: Can you talk a little bit about how your team is structured? So we have cyber leaders for each of our kind of primary cyber domains. And we've recently reorganized those teams to be vertically integrated. So for each domain area, the team has end-to-end accountability for delivering their products and services. From product ownership and strategic planning all the way through engineering delivery and operational support. So those domain areas include things like identity and access management, network security, endpoint security, data protection. Each of those domain areas, again, has end-to-end responsibility for caring for their products.

8:36And then the other part of my organization, as I mentioned, is the technology risk management function, which is tightly integrated with those domain areas that I just mentioned. But that risk management function has responsibility for all of our internal controls and compliance, our interaction and integration with our external regulatory partners, third-party risk management. And again, just caring for the overall risk approach for the technology organization so that we make sure that we operate within our risk tolerance.

9:09Peter High: You've been a CISO twice, technically, within the organization. And in the interim, you served as Ally's Interim Chief Information and Data Officer. Talk a bit about some of the priorities you inherited and where you focused your attention during the period in which you were the interim leader. Yeah, so for me, when I stepped into that interim role, it was really important that we maintain momentum. We had a very solid technology strategy, and we're executing well on that strategy. and obviously the business is moving at a very rapid pace right now. So it was critical for us to keep that momentum.

9:43Given my kind of long history at Ally, I found it fairly straightforward to step into that role on an internal basis and carry on with the work that we were doing. Of course, when you step into an interim role from within the organization, that normally means that your peer group now becomes kind of your leadership team. So another big priority for me was maintaining cohesion within that technology leadership team. We've got a great team of technology leaders, many of whom have been here for a while. So it was very important for me that we all continue to operate really well together during that interim period.

10:21I had great support from the team and just made sure that we all stayed connected and that we were communicating well, despite the fact that we were going through some transition. And I think as a result, we were able to make some really great progress throughout that interim period. And now that our full-time CIO has stepped into place, again, that transition went quite smoothly and we carry on.

10:45Peter High: Fantastic. An interim leader has to provide continuity while making decisions that can't wait for the permanent appointment. How did you think about changes you needed to advance versus those that are best left to your successor? Yeah, I thought for us it was important to just stay grounded in our overall enterprise strategy and use that as our North Star. So any actions that we were taking that were aligned to the enterprise strategy or that were just a continuation of work that we were doing, those were easy kind of no regrets moves that we could make. And we had a bias for action, a bias for decision making during the interim period.

11:26We didn't want to go into kind of a holding pattern. So we just made sure that we stayed grounded in the enterprise strategy and kept carrying forward there. There were a few things that came across my desk that would be a potential change in direction or a decision with longer term implications. And so there were a few of those that we reserved for the full time CIO when he stepped on board. But on the whole, I would say that the goal was to just keep operating kind of with the same sense of urgency that we always do.

12:00Peter High: You mentioned a short while ago, Spencer, that you've been with the organization for a considerable tenure. It's actually just past 20 years. Congratulations on your anniversary there. and I wonder though, was there anything about occupying that interim position that was nuanced for you or taught you, gave you an appreciation or a set of insights you hadn't had previously as a result of occupying that chair for a time? Well, like I said, a lot of it was familiar to me. Having reported to that role for 20 years, I had a good sense of what the role was all about. I suppose one thing that did surprise me was just, the demands on your time and the fact that those demands come from so many different directions.

12:44Again, no single thing was a surprise, but it was sort of the cumulative effect that was a bit surprising to me. And I have a kind of a better appreciation and sympathy for just how much there is to navigate when you're operating as an enterprise CIO or really any other leader kind of at that level. In terms of what the technology organization needed to do and was expected to do, that was all quite clear. Our strategy was well-defined. The role we play in delivering on the enterprise strategy was clear. I really saw that interim period as an opportunity to make sure that the rest of the technology team was clear on the enterprise strategy and clear on the role that we play.

13:29I put a big focus on really connecting our team to enterprise objectives and trying to really kind of show them the straight line between the work they do and the outcomes we're trying to achieve as a business.

13:45Peter High: The company appointed Mark Mathewson as the chief information data officer in July, came over from Capital One. You mentioned it was a smooth transition from you to him. And I'd love to hear more about it, though, how you how you thought about bringing him as an outsider, in his case, unlike yourself, on board, the transition points, some of the things that you and he did to ensure that it's been a successful and somewhat easy transition, as easy as it can be, at least? Well, as you said, he comes in from another financial services organization, and he has an extensive background in financial services.

14:19So I've been really pleasantly surprised by how seamlessly he has been able to step into the role. There are a lot of parallels between the work we're doing and work that he's done previously. You know, bringing him up to speed on our capabilities and our priorities and our focus has been rather straightforward. Of course, we put together, you know, a thoughtful onboarding package and onboarding plan. And Mark's been really great about just methodically stepping through that and asking a lot of great questions. So, yeah, I really appreciate the way he's come into the organization, open-minded, but also with a background and perspective that can really help us to map out the path forward.

15:05Peter High: So now having occupied both seats for a time, CIDO, CISO, where do you see overlap between those? Where can some productive tension between them benefit the enterprise? I wonder what other sort of comparable insights have come to mind now having had a tenure in each of those positions. Yeah. I think it's really important for the CIDO and the CISO to be completely aligned on objectives. And I think that is rather natural, especially in today's environment. it. The CIDO is well aware of the criticality of cyber defenses and resiliency. And I think Mark and I share the mindset that we want to shift left as much as possible, you know, the development of those capabilities into our overall, you know, life cycle.

16:02So I have found that that our perspectives are well aligned, and there's not a lot of natural tension. But of course, you know, I need to have a strong and independent voice when we're talking about matters of protection and risk management. And again, I think our culture and his style and my style definitely allows for that healthy debate and dialogue when we have to balance, say, speed against risk or things like that. Yeah.

16:33Peter High: Prior to taking on the CISO role for the first time, you'd had a series of leadership roles within technology, including multiple divisional level chief information officer roles as well. As the CISO discipline grows, there are numerous people that are growing within that discipline, creating a lot of depth, but perhaps at the expense of some breadth. You had a lot of breadth before taking on this set of responsibilities. I wonder, you obviously don't have a counterfactual to your own set of experiences, but what's been valuable in getting to know the organization writ large in a variety of different ways with responsibilities, certainly within technology, but separate from information security, cybersecurity specifically, now that you've had these responsibilities at CISO?

17:21I appreciate the question. I think I am somewhat unique in the fact that I'm coming into the CISO organization from more traditional engineering and delivery roles. But I think that can be a real benefit to the role and to the organization. And I see that as part of my mandate or part of my remit, really, is to bring the perspective of a delivery leader into an organization that has a lot of deep expertise and focus kind of within it already. My focus is on ensuring that our cyber organization really understands well the mission of their counterparts across technology and that they're well plugged into that mission and really try to break down any walls or barriers that exist between the teams.

18:13you know if you're not careful there can be cases where the cyber organization is sort of imparting requirements onto the rest of the technology organization and again if you're not careful sometimes that can even be kind of late in the game or you know we can sometimes have priorities that can feel like a fire drill and so with that delivery background and the experience of having been a partner of the cyber organization, I'm really trying to kind of, again, create a greater cohesion and connectivity across the organizations, shift left wherever we can, and really kind of jointly think about security by design across kind of all dimensions of technology delivery.

19:02Peter High: Yeah, really interesting perspectives, Spencer, I appreciate you sharing those. Allies developed a standardized sort of hybrid cloud environment in a centralized cloud-based customer data platform. How has the company built security and resilience into those platforms without slowing adoption and innovation in the process? We're fortunate in that we've made significant investments in those capabilities just over the course of the last few years. And in both cases started from a clean sheet. So in the build out of our cloud posture, both public and private cloud, as well as in the build out of our centralized data platform, we started from scratch and were able to really think about resiliency from the beginning.

19:54Our cloud environment is highly templatized and standardized. And so wherever possible, we build resiliency patterns into those templates. And then as application teams prepare for migration to the cloud, they adopt the kind of resiliency standards by default when they consume those templates. So again, fortunate in the way that we approached that and the fact that we were able to build that in from the beginning. But now having done so, the adoption of the cloud or the adoption of our enterprise data platform means that you just really don't have to think about resiliency design on a case by case basis.

20:42And so it really does not slow the teams down at all. We made the investment up front so that they can move quickly now with the patterns we built.

20:49Peter High: Yeah, really interesting. I also know you conduct enterprise-wide crisis simulations, penetration testing, and external assessments as well, all appropriate hygiene for an organization like yours. Can you talk a bit about what makes a cyber exercise truly useful and how you turn the lessons from a simulation into lasting operational improvements? Yeah, we believe firmly in the value of those exercises. But in order to get value from them, first of all, you've got to have the right stakeholders engaged. And we are thoughtful about conducting enterprise-wide exercises on a regular basis with involvement of everyone from the CEO on down through business leaders, technology leaders, risk leaders, and members of their teams.

21:38So it's really critical that we have the right people engaged and that we really test our assumptions and kind of stretch ourselves outside of normal operations or outside of our comfort zone. And so we recently conducted an exercise that simulated multiple concurrent threat vectors and conditions that were maybe a little outside the normal. So that, again, we really sort of challenge our thinking, challenge our processes, and identify opportunities for improvement. That exercise that we recently conducted spanned three days. So it's a significant investment of time and focus. But if done well, it really gets people thinking.

22:26And then, of course, it's really critical that we capture the findings and have a clear after action report, which we always do. And that we then have like a diligent and thorough process for following through all those things. I mean, as you know, with cybersecurity, resiliency, risk management, it's important that you're just constantly evolving your capabilities and uplifting your capabilities. And the exercises are, I think, one of the key inputs into how we think about that evolution.

22:55Peter High: Yeah, I admire the way in which you're taking what is in some cases the theoretical and introducing the practical and the learnings associated with it and hopefully the hygiene, the muscle memory, the habits that will ensure that the organization remains safe and safeguards its most important assets. I mean, on that habit part, you know, having, you know, sort of exercised it, practiced it, of course, then when real situations arise, you know, people have a good sense of what to do, who to work with, who to reach out to, how we communicate. So the practice is really critical for our preparedness.

23:31Peter High: Alley has made a major investment in an AI platform that's leveraged now across the enterprise. I wonder, how has the rapid adoption of AI at Alley changed your own thought about the threat model, the priorities of your security organization? Obviously, there's a lot written about the additional threats that are caused by artificial intelligence, and I'd love to understand the ways in which you think about countering those. Yeah, there's a lot there. So yeah, first, we felt that it's important to make AI accessible and available to everyone across the enterprise. And by exposing all of our teammates and associates to AI, it not only identifies opportunities to leverage it, but also I think sort of just kind of breaks down the fear factor and helps people to understand just the practical ways that it can make us all more effective and better.

24:26better. So I'm really happy with that decision that we've made to make it available across the enterprise. We had to do so very thoughtfully, making sure that we have the right guardrails in place. All of our AI solutions sit within our four walls in our own cloud environments so that we have full control over the AI solutions and so that our data is never used to train external models. So that's been a great boost to the organization. And we have some really interesting metrics on just how extensively it's being used by all of our associates. So it's fascinating to watch the uptake and the usage and to hear the stories of the people that are leveraging it.

25:14But then I think another part of your question was just how do we think about the evolving threat landscape? And, you know, our defenses against AI risks, we like to think of it in three buckets. One is there's certainly opportunities for us to leverage AI as a part of our defenses. And we're doing that extensively. then we also need to protect against the external threats of AI right as AI sort of represents a dual opportunity and threat we can use it to to enhance our defenses and do things that at a scale that humans just simply can't do so it definitely uplifts our defenses but of course also uplifts the capabilities of threat actors and so that second category of work that we need to do is ensuring that we've got strong defenses against the threats posed by AI from the outside.

26:11And then the third bucket that we think about is just protecting our own use of AI and making sure that we continue to use AI in safe and sort of contoned patterns. So my team is responsible for all three of those. And it's an exciting space right now. Things are just changing so rapidly. And although my team has that responsibility, we are really thoughtful about engaging the full organization across each of those three categories. I've been really happy this year with just the degree of partnership that we've been able to establish across the whole technology organization in contributing to our response to frontier AI threats and everything that we need to put in place.

26:58Peter High: Very interesting. Very interesting. How do you think about building an ecosystem, Spencer, to deliver what you've described? One of the interesting opportunities and challenges, frankly, is the constant innovations by bad actors, new threats that emerge, but also, thankfully, a lot of innovative companies that are filling the gap and countering those emerging threats as well. And so I can imagine it's necessary to remain abreast, for example, with Silicon Valley and other innovation hubs, venture capitalists, where they're investing, why, what emerging companies are appropriate for an organization like yours.

27:39Peter High: How do you think about the process of assembling an ecosystem and remaining aware of new solutions that might be helpful? It's a great question. And it's kind of a tricky balance right now that we're trying to walk. We have a bias towards sort of managing cohesive platforms and ecosystems. So in general, we would prefer to have enterprise-grade platforms for our security tooling that extend across multiple domains. But as you said, at the same time, there are all these emerging capabilities and new entrants into the market who have some very capable kind of point solutions for specific dimensions of kind of managing AI risk.

28:28So we do exactly as you were saying, stay in touch with BC partners and kind of the startup ecosystem. We're onboarding right now a handful of new tools that didn't even exist six months ago. And we recognize that there's some, you know, that we need to remain flexible. We may onboard tools or partners or capabilities that serve our needs today and for the near term, but things may evolve. And a year from now or two years from now, the ecosystem might look different and we may need to pivot. At the same time, we have these enterprise grade partners who offer, you know, significant capabilities in our environment.

29:15and we're staying closely in touch with them to understanding how their capabilities are evolving and where they're introducing either AI into their existing tools or they're adding new tools and capabilities to their offering. And where it makes sense, we'll adopt those tools as well because they have a kind of a natural fit into our existing ecosystem. So it's a rapidly evolving space. I think in some cases we're adding complexity just in terms of the tools mix that over time we would hope to sort of rationalize and simplify. But some of that complexity is necessary right now just to make sure that we've got every need covered with the strongest, latest capability.

30:02Peter High: Very interesting. And I wonder, Spencer, are there other ways in which you stay current? Are there voices you listen to, things you read or listen to that you would recommend to others that have been particularly helpful in the pathway to remaining current as to the emerging or evolving state of the art? One thing I've been really intrigued by as I've stepped into the CISO role is just how strong the community of cyber professionals is and how tightly networked they all are. And I've been happy to join a number of new organizations that connect me with peers across financial services and then even across other industries more broadly.

30:49I've learned a ton from those folks, and there's just a great amount of information sharing and knowledge sharing that happens within those communities. So I would say for anyone starting in a cyber career, I would highly recommend tapping into those networks wherever possible. and then beyond that i think it's just incumbent on all of us to to stay current with kind of any and all sources of information around emerging technologies um so uh whether it's podcasts and and also just kind of news and current events um i tend to listen to kind of technology podcasts on my way into work and then uh on my drive home from work uh more like just global news in general But it's amazing recently how much of that global news has had a technology bent or an AI bent to it.

31:41So not one source that I would point out, but I think it's important just to really rely on a diversity of sources. Our partner ecosystem as well, I mentioned, is an incredibly valuable source of information. whether that be technology providers themselves and what they're doing and seeing and hearing or whether it's folks with kind of an ear to the ground in the startup ecosystem and the world of bintechs. So we're constantly talking to partners out there and hearing from new companies about how they're thinking about the world today.

32:16Peter High: Makes sense. Great suggestions all, Spencer. And thank you so much for a great conversation. Fascinating to hear more about your experience, your 20 years now with Ally, the evolution across multiple leadership roles, and some of your views in terms of what's to come. I appreciate a great conversation. Thank you so much. Thank you, Peter. I really enjoyed it. Appreciate it. Thanks for listening to Technovation. If you enjoyed this conversation, subscribe and leave a rating. It helps more leaders find our podcast. Thank you, and I look forward to seeing you next time.

32:52Thank you.