Security by Design: How Ally Financial’s CISO Builds Resiliency Into the Cloud

A digital-only bank can’t afford to retrofit security. Ally Financial builds it in from the start.

In this episode of Technovation, Peter High speaks with Spencer Cremers, Chief Information Security Officer at Ally Financial, about designing security and resiliency into cloud infrastructure by default — and what that requires organizationally.

Cremers spent 20+ years at Ally progressing through divisional CIO and engineering roles before becoming CISO, including a stretch as interim Chief Information and Data Officer. That delivery background shapes how he positions security: not as a gatekeeper handing down requirements late in the cycle, but as a design partner embedded from the start.

Key Highlights:

Why Ally’s cloud environment uses templatized resiliency patterns so application teams inherit security standards automatically

How a three-bucket framework separates AI-in-defenses, AI-enabled external threats, and governing Ally’s own AI use

What Cremers learned running a three-day, CEO-involved crisis simulation with concurrent threat vectors

Why a CISO with a delivery background can dismantle the adversarial dynamic between security and engineering

How Cremers managed the interim CIDO role without putting the organization into a holding pattern

This episode is sponsored by Tines. Freedom to build. Complete security. No compromises. Learn more at tines.io