ciso

The Office of the Chief Financial Officer (OCFO)

<div>
 
 
 Government of the District of Columbia
 
 
 
 
 Office of the Chief Financial Officer (OCFO)
 
 
 
 
 
 
 
 
 Director Information Technology Security
 
 
 
 (CISO /Cyber Security Leader &amp; Operations)
 
 
 
 $176,948.00 - $214,712.00 Annually
 
 
 
 
 Washington DC
 
 
 
 
 
 
 The Office of the Chief Financial Officer (OCFO) is the steward of the Government of the District of Columbia&rsquo;s (District&rsquo;s) finances. Since its creation in 1996, OCFO&rsquo;s mission is to ensure the financial integrity and long-term fiscal health of the District. OCFO accomplishes this mission by ensuring balanced budgets, unqualified or &ldquo;clean&rdquo; audit opinions, and access to quality credit markets with high and improving bond ratings.
 
 
 
 
 
 OCFO&rsquo;s operational responsibilities include forecasting the District&rsquo;s revenues and financial condition, developing and managing the District&rsquo;s budget, administering the District&rsquo;s taxes, and executing and recording the District&rsquo;s financial transactions. In addition, OCFO administers the District&rsquo;s lottery and gaming programs, and oversees the finances of the University of the District of Columbia and the Washington Convention and Sports Authority (Events DC).
 
 
 
 
 
 We are searching for a
 
 Director of Information Technology Security.
 
 This position is in the Office of the Chief Financial Officer (OCFO), Office of the Chief Information Officer (OCIO). The incumbent is responsible for establishing and managing the OCFO&rsquo;s security strategy and programs to ensure the protection of both physical and informational assets.
 
 
 
 
 
 
 Duties include, but are not limited to:
 
 
 <ul>
 <li>
 Develop and lead the enterprise-wide security strategy
 </li>
 <li>
 Direct the development, implementation, and enforcement of security policies, standards, and procedures, overseeing cybersecurity operations, including threat detection, incident response, vulnerability management, and data protection.
 </li>
 <li>
 Oversee cloud and vendor-hosted platforms security initiatives; executing disaster recovery and business continuity planning and testing; defining security requirements in contracts.
 </li>
 <li>
 Provide strategic guidance on security requirements for new systems; developing and delivering security awareness and training programs; and supervising and mentoring security staff.
 </li>
 <li>
 Performs other related duties as assigned
 </li>
 </ul>
 
 
 
 
 
 Minimum Qualifications
 
 
 
 Eight (8) years of progressive experience managing and directing enterprise information security programs in a government or complex organization; leading, developing, and implementing security policies, standards, and enterprise security strategies; developing and managing cybersecurity programs; overseeing vendor security requirements and contract compliance; and providing technical advisory support for risk management and disaster recovery. Experience must also include leading security awareness or training programs, conducting and overseeing security audits, coordinating with senior leadership and external stakeholders, and at least two (2) years of supervisory experience over technical and managerial staff.
 
 
 
 
 
 For initial review, please submit your resume to
 
 anita.tolani@dc.gov
 
 or to the Office of the Chief Financial Officer, Human Resources Division, located at 1101 4th Street, SW, Suite W220, Washington, DC 20024.
 
 
 
 
 
 To complete an application or for additional details related to this vacancy, please visit www.cfo.dc.gov and reference announcement number: 26-IT-OCIO-0006.
 
 
 
 
 
 The OCFO offers a competitive salary and benefits package including medical, dental, retirement, and educational assistance.
 
 
 
 
 
 
 The Office of the Chief Financial Officer is an EQUAL OPPORTUNITY EMPLOYER
 
 
</div>

Director Information Technology Security (CISO)

Novant Health

<div>What We Offer:
<div>
The Chief Information Security Officer (CISO) will serve as the senior executive responsible for 
cybersecurity, digital trust, and technology risk across a large integrated healthcare system. Reporting to the Executive Vice President &amp; Chief Digital and Information Officer, the CISO will lead the development and execution of a modern enterprise cybersecurity strategy that protects clinical operations, patient data, and digital platforms while enabling innovation and growth.</div><div></div><div> 
Healthcare is rapidly becoming one of the most digitally complex industries. From electronic health records and connected medical devices to artificial intelligence and digital patient engagement platforms, technology is deeply embedded in care delivery. The CISO will play a critical role in ensuring the organization remains secure, resilient, and trusted while advancing its digital transformation journey.</div><div></div><div> 
This role goes beyond traditional cybersecurity operations. The CISO will operate as an enterprise risk leader responsible for shaping how cybersecurity supports patient safety, operational continuity, and responsible digital innovation.</div><div> 
The successful candidate will partner closely with executive leadership, clinical teams, and the board to ensure cybersecurity is embedded into enterprise strategy rather than treated as a standalone technical function.</div>
What You'll Do:

Education: 4 Year / Bachelors Degree, required. Computer Science, Information Systems, Engineering or related academic discipline. Graduate Degree, preferred. Information Technology.
Experience:<ul><li>
10+ required. Minimum of 15 years. Progressive leadership 
experience in cybersecurity, information security, or technology risk.</li><li>
10+ preferred. Minimum of 15 years. Experience leading cybersecurity programs in large, complex organizations.
</li></ul>Licensure/Certification:
<ul><li>CISSP and CompTIA Security+ and ITIL Foundation (or equivalent), required.
</li><li>CISM, CRISC, CGEIT, CISA, CASP, COBIT Foundation (or equivalent), required.</li></ul><div>
Additional Skills/Requirements (required)</div><ul><li>
Demonstrated ability to engage with executive leadership teams and boards of directors</li><li>
 Experience building or transforming cybersecurity programs at enterprise scale.</li></ul><div>
Additional Skills/Requirements (preferred)</div><ul><li>
Strong understanding of healthcare regulatory and operational environment</li></ul></div>

SVP & Chief Information Security Officer

CVS Health

<div>We&rsquo;re building a world of health around every individual &mdash; shaping a more connected, convenient and compassionate health experience. At CVS Health&reg;, you&rsquo;ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger &ndash; helping to simplify health care one person, one family and one community at a time.<h2 class="jobSectionHeader">
Position Summary</h2>
The Vice President, Cyber Defense &amp; Threat Intelligence is a senior executive responsible for designing, building, and operating CVS Health's global defensive cyber capability. This leader commands the enterprise Security Operations Center (SOC), Computer Security Incident Response Team (CSIRT), Cyber Threat Intelligence (CTI) program, Insider Risk Operations, Artificial Intelligence Security Operations (AI SecOps), Security Data Analytics, Penetration Testing, Red/Blue Team operations, and Crisis Incident Response &mdash; A unified platform protecting one of the nation's largest healthcare enterprises and the sensitive personal health information of more than 180 million Americans. 
Reporting directly to the CISO, this role is the company's senior operational defender and primary technical authority during significant cyber events. The VP operates within CVS Health's CISO leadership team and will build a culture of precision, speed, and mission orientation across a multi-disciplinary team, translating intelligence into prevention and detection while ensuring that operational outcomes meet the expectations of regulators, the Board, and executive leadership.<h2 class="jobSectionHeader">
Key Responsibilities</h2>
Security Operations Center (SOC)
<ul><li>Own 24x7x365 enterprise SOC operations, ensuring continuous monitoring, detection, and triage across on-premises, cloud, and hybrid environments.</li><li>
Drive SOC maturity through automation, SOAR playbook development, and metrics-driven performance management &mdash; targeting measurable reductions in mean time to detect (MTTD) and mean time to respond (MTTR).</li><li>
Ensure SOC staffing, tooling, and process design meets HIPAA, PCI-DSS, and applicable state regulatory expectations for continuous monitoring of PHI/PII environments.</li><li>
Lead vendor and MSSP relationships supporting SOC augmentation, establishing clear SLAs and escalation protocols.</li></ul>
Cyber Threat Intelligence (CTI)
<ul><li>Establish and mature an enterprise CTI program that delivers operationally relevant, decision-ready intelligence to executive, technical, and legal stakeholders.</li><li>
Maintain active participation in sector-specific intelligence sharing communities (H-ISAC, FS-ISAC where applicable) and government partnerships (CISA, FBI, HHS/OCR).</li><li>
Develop geopolitical and nation-state threat awareness programs that inform executive decision-making and enterprise risk posture.</li><li>
Integrate CTI feeds directly into SOC detection logic, vulnerability prioritization, and red team planning.</li></ul>
Computer Security Incident Response Team (CSIRT)
<ul><li>Lead CSIRT operations responsible for classification, investigation, containment, eradication, and recovery of all significant security events.</li><li>
Own incident response plans, runbooks, and tabletop exercise programs &mdash; ensuring alignment with legal counsel, privacy, compliance, and communications teams.</li><li>
Serve as primary technical authority for all Severity 1 and Severity 2 security incidents; ensure appropriate executive and regulatory notification in accordance with applicable breach notification laws (HIPAA, state data breach statutes, SEC cybersecurity disclosure rules).</li><li>
Maintain chain-of-custody and forensic evidence standards that support potential litigation, regulatory investigation, or law enforcement cooperation</li></ul>
Insider Risk Operations
<ul><li>Build and operate a formal Insider Risk program capable of detecting, investigating, and responding to malicious, negligent, and compromised insider threats at enterprise scale.</li><li>
Partner with Human Resources, Legal, and Employee Relations to ensure insider risk investigations are legally defensible, appropriately scoped, and compliant with applicable employment law and privacy regulations.</li><li>
Design behavioral analytics and UBA/UEBA detection capabilities that distinguish anomalous from malicious activity while minimizing employee privacy intrusions.</li><li>
Develop escalation protocols for referral of insider cases to law enforcement or legal action where appropriate.</li></ul>
Artificial Intelligence Security Operations (AI SecOps)
<ul><li>Establish CVS Health's enterprise AI Security Operations function &mdash; responsible for monitoring, detecting, and responding to threats targeting AI/ML systems, LLMs, agentic workflows, and AI-powered business processes.</li><li>
Develop detection and response capabilities for emerging AI threat vectors including prompt injection, model extraction, adversarial inputs, training data poisoning, and AI supply chain risk.</li><li>
Partner with the Enterprise AI Platform team to embed security monitoring into AI pipelines, model governance workflows, and API integrations.</li><li>
Develop and publish AI security incident response playbooks specific to healthcare regulatory context and PHI exposure risk.</li></ul>
Security Data Analytics &amp; SIEM/SOAR Engineering
<ul><li>Own the enterprise security data platform &mdash; including SIEM architecture, data lake engineering, telemetry ingestion pipelines, and security analytics &mdash; ensuring full visibility across the environment.</li><li>
Lead development of advanced detection analytics, behavioral models, and machine learning-assisted threat hunting capabilities.</li><li>
Establish and maintain security data governance standards, ensuring log retention, integrity, and availability consistent with legal hold, regulatory, and forensic requirements.</li></ul>
Drive measurable improvement in detection fidelity &mdash; reducing false positive rates while increasing signal quality across all detection layers.
Penetration Testing
<ul><li>Manage the enterprise penetration testing program &mdash; including internal assessments, application testing, red team operations, and third-party engagements &mdash; on a risk-prioritized schedule.</li><li>
Ensure testing scope covers traditional infrastructure, cloud-native environments, AI/ML systems, mobile applications, API surfaces, and physical security where relevant.</li><li>
Drive clear, actionable reporting of findings to technical owners and executive leadership, with tracked remediation metrics.</li><li>
Maintain compliance with regulatory testing requirements (e.g., PCI-DSS penetration testing mandates, HIPAA technical safeguard assessments).</li></ul>
Adversarial Operations
<ul><li>Lead a mature adversary simulation program that continuously stress-tests CVS Health's detection and response capability against real-world threat actor TTPs, including nation-state and financially motivated adversaries.</li><li>
Operate Purple Team exercises that close the loop between red team findings and blue team detection improvements &mdash; with documented, measurable outcomes.</li><li>
Ensure red team operations are appropriately scoped, legally authorized, and operationally deconflicted with SOC to avoid unintended disruption.</li><li>
Leverage MITRE ATT&amp;CK framework as the common language for adversary emulation, detection coverage assessment, and security control validation.</li></ul>
Incident Crisis Response &amp; Executive Communication
<ul><li>Serve as the senior operational executive during declared cyber crises &mdash; coordinating technical response, legal liaison, executive briefings, and regulatory notification timelines in close collaboration with the SVP, Deputy CISO and other CISO leadership team members.</li><li>
Develop and maintain the enterprise Cyber Crisis Management Plan in coordination with Enterprise Risk Management, Legal, Communications, and Board-level stakeholders.</li><li>
Own communications to the CISO, SVP, CFO, CEO, Board Audit Committee, and external regulators during significant incidents &mdash; ensuring precision, legal accuracy, and appropriate confidentiality.</li><li>
Lead post-incident review processes that produce legally defensible records, root cause analysis, and measurable control improvements.</li></ul><h2 class="jobSectionHeader"> 
Leadership &amp; Organizational Responsibilities</h2><ul><li>
Recruit, develop, and retain a high-performing, diverse team of cyber defense professionals across SOC, CSIRT, threat intelligence, and offensive/defensive security disciplines.</li><li>
Establish a culture of continuous improvement, threat-informed defense, and mission orientation that operates effectively under pressure.</li><li>
Develop annual operating budgets, headcount plans, and vendor strategy for all functions within scope; present business cases for investment with clear ROI framing.</li><li>
Represent cyber defense operations in executive forums, Board presentations, regulatory examinations, and external audits.</li><li>
Partner with the CISO and SVP, Deputy CISO on enterprise security strategy, architecture, and policy</li></ul>
&mdash; ensuring all cyber defense operations are aligned with enterprise-wide security direction and that the VP's functional scope is clearly delineated from adjacent leadership mandates.<ul><li>
Serve as a visible external representative of CVS Health's security posture through industry conferences, regulatory engagement, and peer collaboration.</li></ul><h2 class="jobSectionHeader">
Required</h2><ul><li>
15+ years of progressive cybersecurity leadership experience, with a minimum of 8 years in senior leadership roles overseeing enterprise-scale security operations.</li><li>
Demonstrated experience leading or significantly maturing a 24x7 SOC, CSIRT, and/or threat intelligence function in a large, complex enterprise environment.</li><li>
Proven track record of leading significant cyber incident response events &mdash; including ransomware, nation-state, and insider threat scenarios &mdash; at enterprise scale.</li><li>
Deep technical fluency across core cyber defense domains: SIEM/SOAR, endpoint detection and response (EDR), network security monitoring, cloud security monitoring (AWS, Azure, GCP), and threat intelligence platforms.</li><li>
Strong executive communication skills &mdash; able to translate complex technical findings into precise, actionable, and legally defensible communications for C-suite and Board audiences.</li><li>
Experience operating in highly regulated industries with significant personal data obligations (healthcare, financial services, retail, or equivalent).</li><li>
Familiarity with HIPAA Security Rule, NIST CSF, NIST SP 800-53, CIS Controls, MITRE ATT&amp;CK, and applicable state data breach notification laws.</li><li>
Experience leading insider risk or behavioral analytics programs with appropriate HR/Legal partnership.</li></ul><h3 class="jobSectionHeader">
Preferred</h3><ul><li>
Healthcare industry experience with direct exposure to HIPAA/HITECH compliance, OCR investigation response, and healthcare-specific threat actor activity.</li><li>
Experience building or maturing AI/ML security operations capabilities &mdash; including detection of prompt injection, adversarial ML, and AI supply chain risk.</li><li>
Background in red team or offensive security operations (OSCP, GXPN, or equivalent).</li><li>
Legal or compliance background, or demonstrated experience working closely with legal counsel in incident response, regulatory notification, and litigation support contexts.</li><li>
Experience testifying before regulatory bodies, law enforcement, or legislative committees.</li><li>
Prior experience at CISO level or as a direct CISO report in a Fortune 50 or equivalent organization</li></ul>
Certifications (Preferred) 
CISSP
CISM
GCIA / GCIH / GREM
GCFE / GCFA (Forensics)
OSCP / GXPN (Offensive)
AWS/Azure/GCP Security Specialty
SANS GSOM / GSE
CISA
Pay Range
The typical pay range for this role is:
$0.00 - $0.00 
This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above. This position also includes an award target in the company&rsquo;s equity award program. 
Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong.
Great benefits for great people
We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families. 
This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility. 
Additional details about available benefits are provided during the application process and on Benefits Moments. 
We anticipate the application window for this opening will close on: 05/11/2026
Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.</div>

VP, Cyber Defense & Threat Intelligence

employers

<div>VP, Chief Information Security Officer | 100% Remote (WFH) Opportunity
General Summary:
EMPLOYERS is a century‑old specialty insurance company in the midst of a deliberate technology modernization designed to reshape how the business competes, distributes, and operates. The Chief Information Security Officer will join at a pivotal moment: when security is not yet fully integrated into the fabric of the business, and when the choices made in the next two years will determine whether security enables EMPLOYERS ambitions or merely trails behind them.
This is not a role for a technician with an executive title. It is a role for a security leader who thinks strategically, communicates fluently with board members and business unit leaders, and understands that the measure of a security program is not how many controls are deployed: it is whether the business can pursue its goals with confidence.
The CISO will report to the Chief Information Officer and will serve as a member of the senior technology leadership team. The security program being built here is still early: existing capabilities without a unifying structure, direction, or connection to business outcomes. That is not a liability. For the right leader, it is a rare opportunity to build something that matters from the ground up.
What This Leader Will Do
Build the Program
EMPLOYERS has security capability. What it does not yet have is a cohesive program: one organized around business outcomes, governed with clear accountability, and staffed to the right skill profile. The CISO will design and implement that program from strategy to execution, building on existing strengths while closing gaps with precision rather than excess.<ul><li>
Define and operationalize a multi-year Security and Resilience Strategy aligned to the CIO's technology modernization goals</li><li>
Establish a program structure, operating rhythm, and governance model that are sustainable beyond any single leader's tenure</li><li>
Right-size the team, prioritizing critical thinking and adaptability over headcount and developing existing talent toward higher capability</li><li>
Implement outcome-based metrics that communicate security posture in terms business leaders can understand and act on</li><li>
Drive rationalization of the existing security technology portfolio, ensuring tools in use are delivering value and directing investment toward genuine capability gaps</li></ul>
Enable the Business
EMPLOYERS is investing in modernization because it needs to compete differently. That modernization introduces new technology, new partners, new platforms, and new risk. The CISO will be present in those decisions (not as a reviewer after the fact, but as a participant in the design).<ul><li>
Serve as a trusted advisor to the CIO, executive team, and Board's Technology Risk and Innovation Committee on security, resilience, and risk</li><li>
Embed security into technology modernization initiatives, including CRM, AI adoption, and digital distribution, at the architecture stage rather than the compliance review stage</li><li>
Develop peer relationships with business unit leaders that make security a collaborative discipline rather than a control function</li><li>
Translate security risk into business consequence in language that informs strategic decisions, not just technical ones</li></ul>
Govern with Discipline
EMPLOYERS operates in a regulated environment. New York Department of Financial Services (NYDFS) cybersecurity requirements, Nevada insurance regulations, CPPA, and emerging AI governance frameworks create a fiduciary obligation, not simply a compliance burden. The CISO will manage that obligation as a strategic responsibility.<ul><li>
Ensure ongoing compliance with NYDFS Part 500 and applicable state and federal regulatory requirements</li><li>
Lead development and validation of business continuity and disaster recovery capabilities through regular tabletop exercises and operational testing</li><li>
Establish a risk communication cadence, to the CIO and to the Board, that keeps leadership accurately informed and appropriately engaged</li><li>
Build governance processes that move at the speed of the environment, not the speed of the annual audit cycle</li></ul>
What This Role Is Not
This position is not a compliance management role. It is not a technology procurement role. It is not a role for a leader who builds influence by controlling access to security decisions rather than by expanding the organization's ability to make good ones.
The CISO who will succeed here will be comfortable with ambiguity, energized by building, and capable of leading a small team of strong people toward outcomes that matter, without the organizational machinery that larger enterprises provide. They will know when to bring in expertise and when to develop it internally. They will earn authority through credibility, not through organizational position.
What We Are Looking For
Experience and Background<ul><li>
Ten or more years of progressive security leadership experience, including demonstrated accountability for security programs in regulated industries</li><li>
Proven experience building or substantially rebuilding a security program (not simply maintaining one) with a small, high-capability team</li><li>
Insurance, financial services, or similarly regulated industry experience preferred; a track record of navigating complex regulatory environments is essential</li><li>
Experience leading security functions through significant technology transformation, including cloud migration, digital platform development, AI adoption, or equivalent</li><li>
Direct experience presenting to and advising boards of directors or executive risk committees on security posture, strategy, and material risk</li></ul>
Leadership and Influence<ul><li>
Ability to build genuine peer relationships with business leaders, building working partnerships grounded in shared business goals rather than transactional compliance relationships</li><li>
Executive presence and communication skills capable of translating complex security concepts into clear business language for non-technical audiences</li><li>
Track record of developing team members by identifying capability gaps and investing in people rather than compensating with headcount or tooling</li><li>
Comfort operating in organizations where the path forward must be created, not inherited; the instinct to build structure without over-engineering it</li><li>
The judgment to distinguish between what needs to be stable and what needs to adapt continuously, and the organizational credibility to lead both</li></ul>
Intellect and Approach
This role requires:<ul><li>
A critical thinker who can reason about adversary behavior, business consequence, and organizational capability without defaulting to vendor frameworks or tool-generated outputs</li><li>
An operator who defines success by outcomes (what the business can do securely), not by activity metrics, control coverage percentages, or audit findings resolved</li><li>
A communicator who can reframe security risk as business intelligence and make that intelligence genuinely useful to executive and board audiences</li><li>
A builder who can create governance processes that keep pace with modern digital environments, not governance designed for infrastructure that no longer exists</li><li>
A leader who invests deliberately in the analytical judgment of their team, because that judgment is the asset that no tool can replicate and no adversary can simply automate around</li></ul>
Technical Scope<ul><li>
Comprehensive understanding of enterprise security architecture across cloud, hybrid, and on-premises environments</li><li>
Familiarity with AI security risk, including model integrity, data pipeline security, and third-party AI supply chain considerations</li><li>
Working knowledge of NYDFS Part 500, NIST CSF, CPPA, and applicable insurance regulatory requirements</li><li>
Experience with security technology portfolio management, including evaluating, rationalizing, and governing tools across the security stack</li><li>
Proficiency with business continuity and disaster recovery program design and operational validation</li></ul>
Location and Compensation.
Work Environment
This position is fully remote, with minimal travel expected. The CISO will maintain regular virtual engagement with the CIO organization, executive leadership team, and board-level stakeholders.<ul><li>
This role potentially and will routinely use office equipment such as computers, phones, printers, and web conferencing technology as examples.</li><li>
This is largely a sedentary role; however, some mobility is required.</li><li>
May work early, late, or occasional weekend hours to accommodate business needs.</li><li>
Occasional lifting of a maximum of 30lbs.</li><li>
Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.</li></ul>
Compensation:
EMPLOYERS offers a competitive executive compensation package including base salary, annual incentive, long-term equity participation, and a comprehensive benefits program commensurate with the seniority and scope of this role
Base Salary Range: $155,000 - $225,000 please follow the link to our benefits page for additional details! EMPLOYERS Benefits and Perks
About EMPLOYERS:
As a dynamic, fast-growing provider of workers' compensation insurance and services, we are seeking a goal-oriented individual willing to put their ideas to work!
We offer a positive, challenging work environment, combined with an opportunity to build your career as you help us grow our business, in innovative and imaginative ways that are uniquely EMPLOYERS&reg;!
Headquartered in Nevada, EMPLOYERS attributes its long-standing success to its most valuable resource, our employees across the United States. EMPLOYERS is known for the quality service and expertise we provide to our clients, and the exemplary work environment we provide for our employees.
We live and breathe our core values: Integrity, Customer Focus, Collaboration, Initiative, Accountability, Innovation, and Personal Fulfillment. These are the pillars that support how we do business with our clients as well as how we treat each other!
At EMPLOYERS, you&rsquo;ll discover an energetic environment that inspires top achievement. As &ldquo;America&rsquo;s small business insurance specialist&rdquo;, we have the resources, a solid reputation and an expanding nationwide identity to enrich your work/life and enhance your career. #LI-Remote
Click our link to learn more! About EMPLOYERS</div>

VP, Chief Information Security Officer

Brown University

<div>Job Description:
Director, Information Security
Office of Information Technology
Brown University
The Director of Information Security in the Office of Information Technology (OIT) is a senior leadership role within Brown University&rsquo;s Information Security Group (ISG). Reporting to the Chief Information Security Officer (CISO), the Director provides strategic and operational oversight for three critical pillars of the University&rsquo;s cybersecurity program: Security Engineering, Security Operations, and Information Compliance &amp; Risk.
The Director provides critical operational continuity in the CISO&rsquo;s absence. This role is responsible for translating institutional vision into actionable plans, ensuring that Brown&rsquo;s digital assets are protected through robust engineering, that security incidents are managed with precision, and that the University maintains a rigorous posture regarding IT risk and regulatory compliance.
Acting as a key liaison between technical practitioners, University leadership, and administrative departments (including the Office of General Counsel and Brown Risk, Audit, and Compliance teams), the Director fosters a culture of continuous improvement and proactive risk management.
This role has technical subject matter expertise and management duties. They may be alerted for unplanned escalation or backup support at any time. They are expected to respond to alerts as appropriate.
Occasional travel to the Providence, RI campus is required for on-site leadership meetings or incident management.
Qualifications:
Education and Experience<ul><li>
Bachelor's Degree required.</li><li>
10+ years of combined IT and IT security experience, with at least 3 years in a significant leadership role.</li><li>
Proven management experience providing strategic oversight and mentorship to multidisciplinary technical teams, ensuring alignment between departmental goals and high-performance execution.</li><li>
Experience with security operations, incident response, and security engineering.</li><li>
Knowledge of privacy regulations (e.g., GDPR, CCPA, FERPA, HIPAA) preferred.</li><li>
Industry certifications such as CISSP, CISM, CISA, or equivalent preferred.</li><li>
Experience with vulnerability management, and security architecture.</li><li>
Experience with cloud security (e.g. Azure, GCP, and AWS) preferred.</li></ul>
Job Competencies<ul><li>
Strong leadership and team-building skills.</li><li>
Ability to manage multiple priorities in a dynamic environment.</li><li>
Excellent verbal and written communication skills.</li><li>
Strong analytical and problem-solving abilities.</li><li>
Knowledge of compliance frameworks and regulatory requirements (e.g. NIST 800-171 and PCI DSS).</li><li>
Ability to work effectively with diverse stakeholders across the institution</li></ul>
A criminal background check and education verification is required. In addition to completing a Criminal Justice Information Services (CJIS).
Benefits of Working at Brown:
Information on the Benefits of Working at Brown can be found here.
Recruiting Start Date:
2026-04-07
Job Posting Title:
Director, Information Security
Department:
Office of Information Technology
Grade:
Grade 13
Worker Type:
Employee
Worker Sub-Type:
Regular
Time Type:
Full time
Scheduled Weekly Hours:
37.5
Position Work Location:
Remote 
Submission Guidelines:
Please note that in order to be considered an applicant for any staff position at Brown University you must submit an application form for each position for which you believe you are qualified. Applications are not kept on file for future positions. Please include a cover letter and resume with each position application.
This position is not eligible for visa sponsorship.
Still Have Questions?
If you have any questions you may contact employment@brown.edu.
Brown is an E-Verify Employer.
EEO Statement:
Brown University provides equal opportunity and prohibits discrimination, harassment and retaliation based upon a person&rsquo;s race, color, religion, sex, age, national or ethnic origin, disability, veteran status, sexual orientation, gender identity, gender expression, or any other characteristic protected under applicable law, in the administration of its policies, programs, and activities. The University recognizes and rewards individuals on the basis of qualifications and performance. The University maintains certain affirmative action programs in compliance with applicable law.</div>

Director, Information Security

Texas Comptroller of Public Accounts

<div><div>OAG - Enterprise Information Security | Chief Information Security Officer | 26-0234 (00056888)<div>
</div>
Organization: OFFICE OF THE ATTORNEY GENERAL<div>
</div></div><div>
Primary Location: Texas-Austin<div>
</div>
Work Locations: ITS - Admin 300 W. 15th St Austin 78701<div></div><div> 
</div></div><div>
Job: Computer and Mathematical<div>
</div></div><div>
Employee Status: Regular<div>
</div></div><div>
Schedule: Full-time<div>
</div>
Standard Hours Per Week: 40.00<div>
</div></div><div>
State Job Code: 0239<div>
</div></div><div>
Salary Admin Plan: B<div>
</div></div><div>
Grade: 32<div>
</div></div><div>
Salary (Pay Basis): 14,583.33 - 17,083.34 (Monthly)<div>
</div></div><div>
Number of Openings: 1<div>
</div></div><div>
Overtime Status: Exempt<div>
</div></div><div>
Job Posting: Mar 12, 2026, 3:24:05 PM<div>
</div></div><div>
Closing Date: Ongoing<div>
</div></div><div>
Description<div></div> 
GENERAL DESCRIPTION 
The CISO leads the Office of the Attorney General&rsquo;s (OAG) information security program, setting vision and strategy to protect information assets, systems, and infrastructure. This role partners with internal divisions, state and federal agencies, and vendors to implement best-in-class security practices aligned with policies and standards.<div>
Key responsibilities include: 
<ul><li>Developing, maturing, and executing OAG&rsquo;s cybersecurity strategy and program.</li><li>Advising the Office of the CIO on security risks and acceptable risk levels.</li><li>Overseeing cybersecurity operations, risk management, and incident response.</li><li>Embedding security into digital transformation initiatives, including cloud expansion and modernization.</li><li>Driving adoption and enforcement of security policies and procedures.</li><li>Leading a high-performing team of security professionals.</li></ul></div>
The ideal candidate demonstrates servant leadership, fosters collaboration, and proactively addresses emerging threats. This position reports to the CIO and supports OAG&rsquo;s mission to deliver secure, high-quality technology services for Texans.
The OAG is a dynamic state agency with over 4,000 employees throughout the State of Texas, and is committed to providing innovative, modern, and value-driven IT services to the agency. We believe that having talented people in the right place while effectively utilizing new tools and technologies enables us to empower the agency to best serve the people of Texas. OAG employees enjoy excellent benefits (https://ers.texas.gov/Benefits-at-a-Glance) along with tremendous opportunities to do important work at a large, dynamic state agency making a positive difference in the lives of Texans. 
ESSENTIAL POSITION FUNCTIONS<ul><li>
Leads the agency&rsquo;s information security function to ensure consistent, high-quality security management aligned with agency goals and the protection of information assets, technologies, applications, systems, infrastructure, and processes.</li><li>
Establishes and enforces cybersecurity standards, policies, and procedures to maintain service continuity during changes, security incidents, or disaster recovery events.</li><li>
Develops and oversees a strategic, comprehensive information security program ensuring confidentiality, integrity, availability, privacy and recovery of organizational information assets.</li><li>
Operates and manages the Security Operations Center (SOC) to monitor infrastructure for cyber threats, including external attacks and insider risks.</li><li>
Builds and leads a skilled team of security professionals responsible for risk reduction, incident response, and collaboration with business and technical stakeholders during cyber events.</li><li>
Directs threat intelligence collection, analysis, and dissemination to internal teams and partner organizations to strengthen cybersecurity posture.</li><li>
Conducts security assessments, risk analyses, and audits; defines and maintains security standards and compliance requirements.</li><li>
Represents the agency in internal and external forums on information security strategy and represents information security in IT and executive governance committee.</li><li>
Oversees security awareness, communication, and training programs to promote a strong security culture across the organization.</li><li>
Performs related work as assigned</li><li>
Maintains relevant knowledge necessary to perform essential job functions</li><li>
Attends work regularly in compliance with agreed-upon work schedule. Telework schedules are permitted for employees based on the agency&rsquo;s approved Telework Plan (if schedule does not adversely affect operations and service levels, and standard hours of operation are maintained). Telework schedules are set by the Departments based on business needs.</li><li>
Ensures security and confidentiality of sensitive and/or protected information</li><li>
Complies with all agency policies and procedures, including those pertaining to ethics and integrity</li></ul><div>
</div></div><div>
Qualifications<div></div> 
MINIMUM QUALIFICATIONS<ul><li>
Education: Graduation from high school or equivalent</li><li>
Education: Graduation from an accredited four-year college or university with major coursework in cybersecurity, information technology, computer engineering, computer information systems, computer science, management information systems, or a related field is generally preferred; experience in the following (or closely related) fields may be substituted for the required education on a year-for-year basis: information security, information technology, or risk management</li><li>
Experience: 10 years of full-time experience working in the following (or closely related) fields: information security, information technology, or risk management</li><li>
Experience and technical mastery in cybersecurity analysis work, with emphasis on security operations, incident management, intrusion detection, information protection, security systems deployment, and security event analysis</li><li>
Experience in building and/or maturing a Security Operations Center, including the integration of monitoring, threat intelligence, forensic analysis, and incident response</li><li>
Knowledge of local, state, and federal laws and regulations relevant to information security, privacy, and computer crime; of the principles and practices of public administration and management; of the limitations and capabilities of computer systems; of technology across all network layers and computer platforms; of operational support of networks, operating systems, Internet technologies, databases, and security applications; of cybersecurity controls, procedures, and regulations; and of incident response program practices and procedures</li><li>
Skill in the use of a computer and applicable software; and in configuring, deploying, and monitoring security infrastructure</li><li>
Ability to manage and oversee the development, monitoring, and maintenance of security processes and controls; to identify problems, evaluate alternatives, and implement effective solutions; to develop and evaluate policies and procedures; to prepare reports; to implement security best practices and awareness; to communicate effectively; and to supervise the work of others</li><li>
Ability to provide excellent customer service</li><li>
Ability to arrange for personal transportation for business-related travel</li><li>
Ability to work more than 40 hours as needed and in compliance with the FLSA</li><li>
Ability to lift and relocate 10 lbs.</li><li>
Ability to travel (including overnight travel) up to 10%</li></ul> 
PREFERRED QUALIFICATIONS<ul><li>
Certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), or Certified in Risk and Information Systems Control (CRISC)</li></ul>
TO APPLY
To apply for a job with the OAG, electronic applications can be submitted through CAPPS Recruit. A State of Texas application must be completed to be considered, and paper applications are not accepted. Your application for this position may subject you to a criminal background check pursuant to the Texas Government Code. Military Crosswalk information can be accessed at https://hr.sao.texas.gov/Compensation/MilitaryCrosswalk/MOSC_InformationTechnology.pdf
THE OAG IS AN EQUAL OPPORTUNITY EMPLOYER</div></div>

OAG - Enterprise Information Security | Chief Information Security Officer | 26-0234

Search 37+ Ciso jobs near you this April. New roles added regularly across leading industries. Apply today.

37 ciso jobs Near Me

Director Information Technology Security (CISO)

SVP & Chief Information Security Officer

VP, Cyber Defense & Threat Intelligence

VP, Chief Information Security Officer

VP, Cyber Defense & Threat Intelligence

Director, Information Security

OAG - Enterprise Information Security | Chief Information Security Officer | 26-0234