Chief Information Security Officer (CISO)

Job Description and Duties

Under the general direction of the Chief Information Officer (CIO), the Chief Information Security Officer (CISO) serves as a high level executive authority for cybersecurity policy, strategy, and IT security governance. The CISO provides high-level direction on cybersecurity risks and investments, advises executive leadership on statewide and departmental policy impacts, and ensures the confidentiality, integrity, and availability of STO’s information assets. The incumbent has broad responsibility for shaping and implementing long-range cybersecurity strategies and ensuring compliance with state and federal mandates. The CISO leads the information security program and exercises significant policy-making authority across all cybersecurity functions.

You will find additional information about the job in the .

Working Conditions

This position is eligible for a hybrid work schedule which includes up to three days of remote work per week. Additional in office days may be required based on the business need.

Special Requirements

• The position(s) require(s) a Background Investigation be cleared prior to being hired.

Electronic applications are encouraged. If submitting a hard copy, please include JC-507504 / Position #820-760-7500-001  in the "Examination(s) or Job Title(s) for which you are applying" section of the application. Hard copy applications received without the required information may not be considered.

Desirable Qualifications

In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:

1. Leadership experience in cybersecurity operations, including direct responsibility for incident response, risk management, security program governance, and cross-functional team collaboration with executive leadership, legal, procurement, and business units.
2. Demonstrated expertise in implementing and maintaining compliance with NIST Cybersecurity Framework (CSF), NIST SP 800-53, FIPS 199/200, and NIST Secure Software Development Framework (SSDF) in enterprise environments.
3. Broad technical experience with enterprise security platforms, SIEM solutions, XDR products, vulnerability management tools, network and cloud security technologies.
4. Experience leading enterprise-wide cybersecurity audits, privacy impact assessments, and regulatory compliance reviews with documented implementation of corrective actions.
5. Proven ability to develop and implement cybersecurity policies, standards, and governance frameworks that align with federal, state, and industry requirements.
6. Demonstrated experience in leading technology recovery/disaster recovery programs, chairing Change Advisory Board, and communicating complex cybersecurity risks, compliance requirements, information security contractual obligations, and strategic recommendations to executive leadership and non-technical stakeholders.

Benefits

Please see the CalHR Benefits Summary page for detailed information.

Minimum Qualifications

Possession of Minimum Qualifications will be verified prior to interview and/or appointment. If you are meeting Minimum Qualifications with education, you must include your unofficial transcripts/diploma for verification in your application packet. Official sealed transcripts or your original diploma (with embossed seal) will be required prior to appointment. If it is determined that a candidate does not meet all Minimum Qualifications, the candidate will be withheld from the eligibility list, rendering them inactive and ineligible to be hired for the classification. All candidates who are determined to not meet the Minimum Qualifications will be contacted in writing and will have 10 business days to respond with additional information supporting their Minimum Qualifications for the classification. Candidates who have been withheld may file an appeal with the State Personnel Board.

Required Application Package Documents

The following items are required to be submitted with your application. Applicants who do not submit the required items timely may not be considered for this job:

• Current version of the State Examination/Employment Application STD Form 678 (when not applying electronically), or the Electronic State Employment Application through your Applicant Account at All Experience and Education relating to the Minimum Qualifications listed on the Classification Specification should be included to demonstrate how you meet the Minimum Qualifications for the position.
• Resume is optional. It may be included, but is not required.
• Statement of Qualifications - Statement of Qualifications (SOQ) is a narrative discussion of how the candidate's education, training, experience, and skills meet the Desirable Qualifications for the position. The SOQ serves as documentation of each candidate's ability to present information clearly and concisely in writing and should be single-spaced with 12-point font. Resumes, cover letters, and other materials will not be evaluated or considered as responses to the Statement of Qualifications. The SOQ must be numbered and include the Desirable Qualification factor typed in bold font. Respond to each Desirable Qualification factor in the same order they are listed and provide specific examples. Responses should be complete, specific, and clear. Include the name of the organization where you gained the experience, the timeframe you gained the experience, your title and level of responsibility, and relevant outcomes and measures of success.