Security by Design: How Ally Financial’s CISO Builds Resiliency Into the Cloud

Spencer Cremers (0:00)

We don't want security to be an afterthought. We want it to be baked in by design. And doing so requires that my team be partnered hand in hand with our engineers and the folks delivering solutions.

Peter High (0:15)

Welcome to Technovation. I'm Peter High, president of Metis Strategy. My guest today is Spencer Cremers. Spencer is the chief information security officer of Ally Financial. Ally is a leading digital financial services company that operates the nation's largest all-digital bank, as well as major auto finance, insurance, investing, and corporate finance businesses. The company serves roughly 9.5 million customers and has nearly $200 billion in assets under management. As the chief information security officer, Spencer leads Ally's information protection, cybersecurity, and technology risk management efforts, helping safeguard the systems and information on which its customers and businesses rely.

Spencer joined Ally 20 years ago and has held several senior technology leadership positions across the company, including his Ally's interim chief information data officer. He served as CIO of multiple divisions of the bank previously as well.

In this conversation, Spencer and I will discuss how Ally's all digital model shapes its approach to cybersecurity and resilience, what he learned from occupying both the CIDO and CISO seats, and how cloud adoption and artificial intelligence are changing the company's threat model. We'll also explore how Ally prepares for cyber incidents and enables responsible experimentation with AI and sustains customer trust in an increasingly complex digital environment. Today's episode is brought to you by Tines 3B. Organizations are pushing teams to move faster with AI. That's creating a wave of AI generated code and unsanctioned automations, leading to rising costs, security risks and huge IT burdens. Meet Tines 3B, a single secure environment that enables employees to build with AI while giving IT and security complete control to run and govern that work. 3B enables effortless building. Describe what you need in plain English and 3B builds a fully functioning workflow. It uses IT authorized connectors, meaning credentials, state protected, and non-technical teams can innovate without taking on unseen risk.

Also, with full visibility across every workflow, IT gets total governance, while features like AutoTune and AutoFix ensure workflows improve and self-heal continuously over time. Employees get the freedom to build while IT gets the control to govern.

No shadow AI, no data leaks, Tines 3B moves IT and security from blockers to enablers, giving teams the speed to innovate without compromising control. Visit the Tines website at tines.com, that's tines.com, to learn more and try 3B for yourself. Now on to the interview. Spencer Cremers, welcome to Technovation. It's great to speak with you today.

Spencer Cremers (2:46)

Yeah. Thank you, Peter. Happy to be here.

Peter High (2:48)

Spencer, I thought we'd begin with Ally Financial, a fascinating organization. Talk a bit more about the company that you are a part of, if you would.

Spencer Cremers (2:58)

Ally is one of the leading auto finance providers in the United States, and we're also one of the largest digital-only banks. We have a fairly focused mission at really excelling at those two key parts of our business.

Of course, as a digital bank, we're very focused on delivering premier digital experiences for our customers that are centered on trust, accessibility, and just ease of doing business.

Peter High (3:30)

Talk a bit about defining digital only. It's fascinating thing, obviously, to be able to say that you are that, and that you are, of course, at scale. Talk a bit further about what that entails, if you would, for the uninitiated.

Spencer Cremers (3:42)

We like to think of ourselves as one of the original fintech disruptors. When we launched our bank, we have this notion that in the current age, branches aren't necessarily critical to delivering services to customers. And so we wanted to be present and available to our customers, kind of where they are and wherever they may be. So we launched with that concerted focus on being exclusively digital. And again, simple, easy to work with, and transparent in the ways in which we interact with our customers. So of course, technology is critical to everything we do with that digital focus.

And it's also important that we constantly reinvent ourselves and continue to evolve our capabilities as customers' expectations evolve and change.

Peter High (4:32)

And talk a bit about your role as Chief Information Security Officer, if you would. What's within your purview?

Spencer Cremers (4:38)

So I have responsibility for cybersecurity, which includes cyber defenses, cyber response, resiliency across kind of all aspects of our technology stack. And then I also have responsibility for technology risk management for the whole technology organization. And that's an important combination. We designed our cybersecurity organization intentionally that way to bring those two components together. Because we believe they're so integral to one another.