fractional Ciso

Fractional Chief Information Security Officer (CISO)

Location: New York, NY (Hybrid)

Commitment: 10–15 Hours Per Week

Role Overview

The Phoenix Group is seeking an experienced Fractional Chief Information Security Officer (CISO) for a part-time consulting engagement. This individual will provide strategic cybersecurity leadership, evaluate existing security controls and governance practices, identify risks and vulnerabilities, and develop actionable recommendations to strengthen the organization's overall cybersecurity posture.

The ideal candidate will have extensive experience in information security leadership, enterprise risk management, regulatory compliance, and cybersecurity strategy, with the ability to advise executive leadership on security priorities and improvements.

Key Responsibilities

• Assess existing cybersecurity programs, policies, procedures, technical safeguards, and administrative security controls.
• Conduct cybersecurity risk assessments, identify security gaps, and evaluate alignment with the NIST Cybersecurity Framework (CSF 2.0).
• Develop and maintain a prioritized risk register documenting vulnerabilities, business impact, and recommended mitigation strategies.
• Evaluate security across Microsoft 365, Microsoft Entra ID, Azure, identity and privileged access management, multifactor authentication, and conditional access.
• Review network segmentation, firewalls, wireless infrastructure, endpoint protection, patch management, security monitoring, and vulnerability management.
• Assess backup and recovery capabilities, ransomware resilience, and opportunities to strengthen existing security investments.
• Evaluate security governance, data classification, retention policies, access controls, and applicable regulatory compliance requirements.
• Review incident response procedures, escalation protocols, disaster recovery plans, and business continuity preparedness.
• Facilitate cybersecurity tabletop exercises and recommend improvements to incident response readiness.
• Assess third-party vendor security risks and recommend improvements to vendor evaluation, monitoring, and security practices.
• Provide ongoing cybersecurity guidance to IT and executive leadership regarding risk management, security investments, and remediation priorities.
• Develop a prioritized cybersecurity improvement roadmap and present findings and recommendations to executive leadership.

Required Qualifications

• 10+ years of progressive experience in IT, cybersecurity, or information security management, including at least 5 years in security leadership, governance, or enterprise risk management.
• Previous experience as a CISO, Fractional CISO, Deputy CISO, Director of Information Security, or comparable senior cybersecurity leader.
• Demonstrated experience conducting enterprise cybersecurity risk assessments and applying the NIST Cybersecurity Framework (CSF 2.0).
• Strong understanding of cybersecurity governance, regulatory compliance, security policies, and enterprise risk management.
• Experience with cloud security, network security, endpoint protection, identity and access management, vulnerability management, and incident response.
• Hands-on knowledge of Microsoft 365, Azure, Entra ID, and hybrid IT environments.
• Experience evaluating incident response capabilities, disaster recovery, business continuity, and ransomware preparedness.
• Ability to develop formal cybersecurity assessments, risk reports, remediation plans, and strategic security roadmaps.
• Strong communication and presentation skills, with the ability to translate technical security risks into actionable recommendations for executive and nontechnical stakeholders.

Preferred Qualifications

• CISSP, CISM, CISA, CRISC, or comparable cybersecurity certification.
• Previous fractional CISO, cybersecurity advisory, or independent consulting experience.
• Experience supporting organizations operating in regulated environments.
• Familiarity with applicable data protection, privacy, and information security regulations.
• Experience conducting cybersecurity tabletop exercises and evaluating organizational recovery readiness.
• Background in cybersecurity budgeting, resource planning, and long-term security strategy.

The Phoenix Group Advisors is an equal opportunity employer. We are committed to creating a diverse and inclusive workplace and prohibit discrimination and harassment of any kind based on race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, genetic information, disability, or veteran status. We strive to attract talented individuals from all backgrounds and provide equal employment opportunities to all employees and applicants for employment.