Chief of Information Security & Privacy (Hybrid)

Chief of Information Security & Privacy

The State Corporation Commission (SCC) Health Benefit Exchange (HBE or Exchange) Division is seeking a talented people leader to serve on its senior leadership team. The selected candidate will set the vision and strategic direction of the HBE’s privacy and security governance, risk, and compliance programs to enable the organization’s mission, and foster a culture of innovation and continuous improvement.

Anticipated Starting Salary Range: $140,000 - $160,000*
Starting Salary: Commensurate with qualifications and experience

This position offers a hybrid work schedule (some in-office and telework days each week) as well as a variety of professional development and training opportunities.

Essential Functions

• Set direction and provide governance and oversight for security, privacy, governance, risk, and compliance aligned to HBE’s mission and priorities.
• Lead, develop, and retain a high‑performing InfoSec team, empowering direct reports and analysts to own operational execution.
• Build and sustain working relationships across legal, business, IT operations, supplier management, program management, finance, SCC divisions, and external stakeholders, including federal oversight bodies, vendors, auditors, partners, and other state‑based exchange counterparts.
• Identify organizational, information, and supply‑chain risk; assess impact and likelihood; and clearly articulate risk posture and trade‑offs to leadership and governance bodies.
• Serve as the HBE’s Senior Information Security Officer and Privacy Officer.
• Ensure organizational alignment with applicable federal and state regulatory frameworks and standards, including but not limited to CMS ARC‑AMPE, IRS PUB 1075, VITA SEC‑530, SCC (and successors).
• Establish, maintain, and evolve HBE security and privacy policies, governance frameworks, and compliance posture.
• Foster a security and privacy culture throughout the HBE.
• Oversee InfoSec‑specific contract compliance, including SLAs, reports, and deliverables.
• Perform related work as required.

* The salary range is intended to serve as a guide only. The actual salary will be determined on a case‑by‑case basis.