Chief Information Security Officer

Information Security Strategy Leader

Advise the Vice President for Technology and Campus Services, senior IT leaders, University leadership, and other stakeholders on information security strategy, risk, requirements, and opportunities: Develop and lead an information security strategy that balances the University's academic, research, clinical, and administrative values with institutional risk and compliance requirements. Convenes Information Security Oversight Committee and provides risk-based framing for ongoing security program alignment. Monitor emerging information security risks and technology trends and translate them into practical, actionable plans for the University. Build trusted relationships across the University and communicate security improvement opportunities to technical and nontechnical constituencies. Maintain close working relationships with the Office of General Counsel, Audit and Compliance, Public Safety, the Center for Research Computing, the Privacy Office, and other relevant units; serve as a liaison between these groups and IT professionals on security matters. Represent the University in national information security organizations, particularly within higher education, and maintain awareness of relevant national trends. Provide authoritative guidance on security requirements associated with applicable laws and regulations, including HIPAA, FISMA, and FERPA. Guide data-management practices and lead University-wide information security policy, IT risk management, third party risk management, compliance, and governance.

Establishes security standards to inform technology service offerings aligned to minimize exceptions and bespoke solutions. Direct and approve the design of security systems, policies, and controls. Ensure that incident response, disaster recovery, and business continuity plans are established and tested. Own the University's information security awareness and training program content and lead outreach, communication, and education to improve campus-wide understanding of security risks, requirements, and solutions. Lead or review investigations following breaches and security incidents, including impact analysis, lessons learned, and recommendations to reduce future vulnerabilities. Report significant security findings and risks to the Vice President for Technology and Campus Services, General Counsel, senior management, and relevant University board committees. Collaborate on policies, practices, and technologies supporting identity and access management. Manage confidential forensic investigations requested by the Office of General Counsel, Privacy Office, Yale Police Department, or other authorized agencies. Align information security practices across infrastructure, research, teaching and learning, applications, and other technology domains. As a member of the IT senior leadership team, contribute to departmental strategy, performance measures, communication practices, organizational culture, and collaborative ways of working. Maintain a program of regular third party assessments of the university's information security capabilities, compliance requirements, and critical IT systems

Required Skills & Abilities

1. Proven ability to build consensus and serve as a collaborative, persuasive senior leader.

2. Demonstrated understanding of the needs of faculty, researchers, administrators, and others who work with highly sensitive data.

3. Ability to explain complex security concepts, issues, and risks clearly and concisely to technical and nontechnical audiences.

4. Thorough knowledge of current compliance and risk-management standards and practices.

5. Experience with disaster recovery, business resumption, contingency planning, auditing, and risk assessment.

Preferred Skills & Abilities

1. Ability to develop creative solutions that advance institutional objectives while maintaining appropriate controls and risk management.

2. Sound judgment and an open, collaborative leadership style that encourages teamwork and cooperation.

3. Strong interpersonal, partnership, management, and coaching skills; ability to work effectively with a broad range of people and organizations.

4. Demonstrated commitment to excellent service and exceptional quality.

Required Education and Experience

Bachelor's Degree and CISA, CISSP or other security certification/accreditation required. A minimum of ten years progressively responsible information technology security/information security audit management experience in a complex environment required; or an equivalent combination of education and experience.

Preferred Education and Experience

Applied experience in a large academic research and health care environment.