Chief Information Security Officer

Job Title

The position is located in the Office of the Chief Information Officer (OCIO) at the Department of the Interior (Department) and reports to the Chief Information Officer.

Responsibilities

The incumbent carries out the following specific responsibilities:

• Set enterprise security strategy. Define company-wide security policy, standards, and risk tolerance, working closely with the CIO and system owners.
• Run the risk management program. Stand up and mature a structured, framework-based approach to identifying, assessing, and treating risk across all systems. Own the enterprise risk register and drive remediation plans to closure.
• Own system security assessment and approval. Decide which systems are cleared to go live and stay live, backed by continuous monitoring rather than point-in-time checkpoints.
• Drive the Zero Trust roadmap. Move the organization toward least-privilege access, strong identity and access management, and phishing-resistant multifactor authentication.
• Lead threat detection and incident response. Own the security operations center (SOC), endpoint detection and response (EDR), enterprise logging maturity, and the incident response process - including meeting mandatory external breach-reporting deadlines.
• Govern core security hygiene. Vulnerability and patch management, penetration testing, secure configuration baselines, and encryption of data at rest and in transit.
• Secure the supply chain. Lead third-party/vendor and software supply-chain security, including software bill of materials (SBOM) practices, and enforce security requirements for cloud service providers.
• Protect operational technology. Oversee security for industrial control systems and SCADA environments - a first-order concern given the physical infrastructure (dams, hydropower generation) this organization operates.
• Report on the program. Deliver security metrics and regular reporting to leadership and external oversight bodies, and support independent annual security audits and audit responses.
• Build the security workforce and budget. Own the cyber talent strategy, role-based and security-awareness training, and lead security budget and investment planning with the CIO and finance leadership.
• Be the principal cybersecurity advisor and spokesperson to senior leadership, oversight bodies, and external government and partner organizations.
• Shape the organization's position on emerging security policy and technologies - including critical-infrastructure protection and AI-enabled systems - and ensure the organization meets or exceeds recognized industry and regulatory security standards.
• Hold the organization accountable for following the security program, and ensure major incidents are escalated and reported on time.
• Engage the broader community. Collaborate with peer CISOs, cross-industry and interagency security councils, and working groups on emerging issues in cybersecurity, AI security, and privacy.
• Lead the security organization the operationally, coordinating closely with infrastructure and business system operational entities, privacy, records, and data governance functions to ensure high performing and reliable platforms and systems, and keep privacy and security governance integrated.
• Partner on AI security. Work with the Chief AI Officer and AI teams to manage AI-related security risk, secure AI model development, and use AI to strengthen security operations.
• Manage the team. Own workforce planning, headcount, and organizational structure for all security staff, including remote and hybrid employees.

If your resume does not include these basic qualifications, you will not be determined qualified for this position. We recommend that your resume includes examples that are clear, concise, and emphasize their level of responsibilities, the scope and complexity of the programs, activities, or services managed; program accomplishments; policy initiatives undertaken; level of contacts; the sensitivity and criticality of the issues addressed; and the results of actions taken.