Chief Information Security Officer

Working at Yale means contributing to a better tomorrow. Whether you are a current resident of our New Haven-based community, eligible for opportunities through the New Haven Hiring Initiative, or a newcomer, interested in exploring all that Yale has to offer, your talents and contributions are welcome. Discover your opportunities at Yale!OverviewAdvise the Vice President for Technology and Campus Services, senior IT leaders, University leadership, and other stakeholders on information security strategy, risk, requirements, and opportunities: Develop and lead an information security strategy that balances the University’s academic, research, clinical, and administrative values with institutional risk and compliance requirements. Convenes Information Security Oversight Committee and provides risk-based framing for ongoing security program alignment. Monitor emerging information security risks and technology trends and translate them into practical, actionable plans for the University. Build trusted relationships across the University and communicate security improvement opportunities to technical and nontechnical constituencies. Maintain close working relationships with the Office of General Counsel, Audit and Compliance, Public Safety, the Center for Research Computing, the Privacy Office, and other relevant units; serve as a liaison between these groups and IT professionals on security matters. Represent the University in national information security organizations, particularly within higher education, and maintain awareness of relevant national trends. Provide authoritative guidance on security requirements associated with applicable laws and regulations, including HIPAA, FISMA, and FERPA. Guide data-management practices and lead University-wide information security policy, IT risk management, third party risk management, compliance, and governance.Establishes security standards to inform technology service offerings aligned to minimize exceptions and bespoke solutions. Direct and approve the design of security systems, policies, and controls. Ensure that incident response, disaster recovery, and business continuity plans are established and tested. Own the University’s information security awareness and training program content and lead outreach, communication, and education to improve campus-wide understanding of security risks, requirements, and solutions. Lead or review investigations following breaches and security incidents, including impact analysis, lessons learned, and recommendations to reduce future vulnerabilities.Report significant security findings and risks to the Vice President for Technology and Campus Services, General Counsel, senior management, and relevant University board committees. Collaborate on policies, practices, and technologies supporting identity and access management. Manage confidential forensic investigations requested by the Office of General Counsel, Privacy Office, Yale Police Department, or other authorized agencies. Align information security practices across infrastructure, research, teaching and learning, applications, and other technology domains. As a member of the IT senior leadership team, contribute to departmental strategy, performance measures, communication practices, organizational culture, and collaborative ways of working. Maintain a program of regular third party assessments of the university's information security capabilities, compliance requirements, and critical IT systemsRequired Skills & Abilities1.Proven ability to build consensus and serve as a collaborative, persuasive senior leader.2.Demonstrated understanding of the needs of faculty, researchers, administrators, and others who work with highly sensitive data.3.Ability to explain complex security concepts, issues, and risks clearly and concisely to technical and nontechnical audiences.4.Thorough knowledge of current compliance and risk-management standards and practices.5.Experience with disaster recovery, business resumption, contingency planning, auditing, and risk assessment.Preferred Skills & Abilities1.Ability to develop creative solutions that advance institutional objectives while maintaining appropriate controls and risk management.2.Sound judgment and an open, collaborative leadership style that encourages teamwork and cooperation.3.Strong interpersonal, partnership, management, and coaching skills; ability to work effectively with a broad range of people and organizations.4.Demonstrated commitment to excellent service and exceptional quality.Required Education and ExperienceBachelor's Degree and CISA, CISSP or other security certification/accreditation required. A minimum of ten years progressively responsible information technology security/information security audit management experience in a complex environment required; or an equivalent combination of education and experience.Preferred Education and ExperienceApplied experience in a large academic research and health care environment.Principal Responsibilities1. Provides expert leadership, guidance and counsel on information security to the CIO, IT senior staff and University stakeholders. Collaborates with campus leadership to develop a strategy for information security that balances the University’s academic, research and administrative values with institutional attention to the risks and requirements generated by an increasingly information-rich and systems-dependent environment. 2. Advises University leaders on emerging information security risks and opportunities created by the University’s role as a world-class institution of teaching, learning and research with increasing global relationships and activities. Responsible for communicating with constituencies across the campus on information security improvement opportunities while building goodwill and relationships. 3. Maintains a close relationship with the offices of General Counsel, the Center for Research Computing, Audit and Compliance and Public Safety; serves as liaison between these groups and IT professionals for matters pertaining to campus IT security. Promotes collaborative, empowered working environments across campus, removing barriers as required for success in a decentralized environment. 4. Maintains awareness of national trends in information security and represents Yale in national information security organizations, particularly within the higher education community. Projects awareness with communications to the University community on current active threats, evolving policy changes, and related trends. 5. Provides expert advice on security requirements necessary for compliance with applicable federal legislation (e.g. HIPAA, FISMA, and FERPA). 6. Provides guidance on the development and implementation of data management practices. 7. Responsible for information-security policies and effective IT risk management and compliance across the University; coordinates campus-wide information security governance. 8. Direct and approve the design of security systems; ensure that disaster recovery and business continuity plans are in place and tested; review and approve security policies, controls and cyber incident response planning. Ownership of the University information security awareness and training program. Advise and collaborate with senior management on building business continuity and disaster recovery plans. 9. Review investigations after breaches or incidents, including impact analysis and recommendations for avoiding similar vulnerabilities; maintain a current understanding the IT threat landscape for the industry; ensure compliance with the changing laws and applicable regulations; translate that knowledge to identification of risks and actionable plans to protect the business. 10. Reports on the status of significant findings to the University CIO, General Counsel, and University Board committees. 11. Collaborates in the policy, practices, and technologies supporting identity and access management policies 12. Manage confidential forensic investigations as requested by the Office of General Counsel, the Privacy Office, Yale Police Department or other agencies as needed. Maintains strong working relationships with IT Senior Management and their teams to align information security practices across Infrastructure, Research, Teaching and Learning, and Applications that best supports balanced institutional goals. 13. As a member of the CIO senior leadership team, contributes to the overall development of department strategic goals, performance metrics, communication practices and culture. Required Education and Experience Bachelor's Degree and CISA, CISSP or other security certification/accreditation required. A minimum of ten years progressively responsible information technology security/information security audit management experience in a complex environment required; or an equivalent combination of education and experience. Required License(s) or Certification(s) Required License(s) or Certification(s): Physical Requirements Physical Requirements:Job Posting Date10/20/2026Job CategoryManagerBargaining UnitNONCompensation GradeAdministration & OperationsCompensation Grade ProfileSenior Leader (M8)Salary Range$180,000.00 - $331,500.00BenefitsA general description of the benefits to be offered with this Managerial & Professional position is available at:Yale BenefitsTime TypeFull timeDuration TypeStaffWork ModelHybridBackground Check RequirementsAll candidates for employment will be subject to pre-employment background screening for this position, which may include motor vehicle, DOT certification, drug testing and credit checks based on the position description and job requirements. All offers are contingent upon the successful completion of the background check. For additional information on the background check requirements and process visit "Learn about background checks" under the Applicant Support Resources section of Careers on the It's Your Yale website.Health RequirementsCertain positions have associated health requirements based on specific job responsibilities. These may include vaccinations, tests, or examinations, as required by law, regulation, or university policy.Posting DisclaimerSalary offers are determined by a candidate’s qualifications, experience, skills, and education in relation to the position requirements, along with the role’s grade profile and current internal and external market conditions.The intent of this job description is to provide a representative summary of the essential functions that will be required of the position and should not be construed as a declaration of specific duties and responsibilities of the position. Employees will be assigned specific job-related duties through their hiring department.The University is committed to basing judgments concerning the admission, education, and employment of individuals upon their qualifications and abilities and seeks to attract to its faculty, staff, and student body qualified persons from a broad range of backgrounds and perspectives. In accordance with this policy and as delineated by federal and Connecticut law, Yale does not discriminate in admissions, educational programs, or employment against any individual on account of that individual’s sex, sexual orientation, gender identity or expression, race, color, national or ethnic origin, religion, age, disability, status as a special disabled veteran, veteran of the Vietnam era or other covered veteran.Inquiries concerning Yale's Policy Against Discrimination and Harassment may be referred to the Office of Institutional Equity and Accessibility (OIEA).NoteYale University is a tobacco-free campus.