CHIEF Information Security Officer

Chief Information Security Officer – Davis, CA, Job ID 88610 University of California Agriculture and Natural Resources Position Summary The Chief Information Security Officer (CISO) assists with the strategic direction of UC ANR's information security program. The CISO provides guidance to the CIO, Cyber-Risk Responsible Executive (CRE), and Senior Leadership; facilitates security planning processes to maintain alignment with University of California system-wide policies; represents the UC ANR in location and system-wide meetings; and helps establish the policies and procedures to safeguard the confidentiality, integrity, and availability of university data across academic, research, and administrative information systems and technology. The CISO reports directly to the CIO and maintains a dotted‑line reporting relationship to the CRE, providing regular updates on security compliance, risk‑management activities, and policy alignment. This position is a career appointment that is 100% fixed. The home department is IT Services. While this position normally is based in Davis, CA, this position is eligible for hybrid flexible work arrangements for applicants living in the State of California at this time. Please note that hybrid flexible work arrangements are subject to change by the University. Pay Scale $126,700/year to $187,700/year Job Posting Close Date This job is open until filled. The first application review date will be 09/16/2026. Key Responsibilities 35% Manage mitigation of the attempts to compromise security protocols. Works with senior and IT management, as well as system-wide colleagues, to create security plans that protect against theft, destruction, alteration, or denial of access to information. Leads the IT security team, including performing hands‑on threat hunting and detection, vulnerability management, and incident triage and remediation. Takes appropriate actions to protect UCANR's information assets and infrastructure. Serves as the location expert on security awareness, best practices, and secure software/hardware design. 30% Manages, maintains, and enforces UC ANR-wide security policies; leads the risk‑assessment process; ensures those policies align with UC-wide security mandates. Collaborates with senior and IT leadership to establish location-wide security standards that enforce UC-wide policy. 20% Makes recommendations to the CIO, the CRE and senior leadership on emerging threats, risk‑mitigation strategies, and security investments; represents UC ANR on university‑wide security councils. 15% Assist in the administration of the security program budget; contribute to the evaluation of security technology vendors and service providers; coordinate the procurement of cost‑effective tools and services. Requirements Bachelor's degree in related area and / or equivalent experience / training 3-5 years of progressive information security leadership with 2-4 years of hands‑on work (incident response, vulnerability management, secure architecture) Broad knowledge of information technology security functional areas and how it relates to research subjects; finance; including credit card transactions; management of IT resources and applications; and general computer use practices. Demonstrated understanding of privacy and security regulations and best practices, including federal and state laws, policies and standards, as well as extensive knowledge about a wide range of privacy / security regulations relevant to higher education. Demonstrated management expertise in determining and recommending actions, for location departments, to follow in IT security and privacy matters. Demonstrated communication skills with project teams, stakeholders, senior management, and external contacts including both technical and non‑technical audiences. Demonstrated interpersonal skills in order to work with both technical and non‑technical personnel at various levels in organization. Demonstrated ability to change the thinking of, or gain acceptance from, others in sensitive situations, without damage to the relationship. Broad knowledge of subject area sufficient for strategic planning, technology assessment and direction. Leadership experience managing technical staff. Experience leading change management activities and managing their impact within the organization. Broad knowledge of technical concepts and basic operating principles of data communications, computer hardware, vendor IT products, and software. Demonstrated oral and written communication skills, including the ability to effectively present technical topics to large groups with potentially varied levels of technical sophistication. Preferred Skills Advanced Degree Certified Information Systems Security Professional (CISSP) Prior experience working within the University of California system or other higher‑education institutions. Special Conditions of Employment Must possess valid California Driver's License to drive a County or University vehicle. Ability and means to travel on a flexible schedule as needed, proof of liability damage insurance on vehicle used is required. Reimbursement of job-related travel will be reimbursed according to University policies. The University reserves the right to make employment contingent upon successful completion of the background check. This is a designated position requiring a background check and may require fingerprinting due to the nature of the job responsibilities. UC ANR does hire people with conviction histories and reviews information received in the context of the job responsibilities. As of January 1, 2014, ANR is a smoke- and tobacco-free environment in which smoking, the use of smokeless tobacco products, and the use of unregulated nicotine products (e‑cigarettes), is strictly prohibited. As a condition of employment, you will be required to comply with the University of California Policy on Vaccination Programs, as may be amended or revised from time to time. Federal, state, or local public health directives may impose additional requirements. Exercise the utmost discretion in managing sensitive information learned in the course of performing their duties. Sensitive information includes but is not limited to employee and student records, health and patient records, financial data, strategic plans, proprietary information, and any other sensitive or non-public information learned during the course and scope of employment. Understands that sensitive information should be shared on a limited basis and actively takes steps to limit access to sensitive information to individuals who have legitimate business need to know. Ensure that sensitive information is properly safeguarded. Follow all organizational policies and laws on data protection and privacy. This includes secure handling of physical and digital records and proper usage of IT systems to prevent data leaks. The unauthorized or improper disclosure of confidential work‑related information obtained from any source on any work‑related matter is a violation of these expectations. Misconduct Disclosure Requirement: As a condition of employment, the final candidate who accepts an offer of employment will be required to disclose if they have been subject to any final administrative or judicial decisions within the last seven years determining that they committed any misconduct; or have filed an appeal of a finding of substantiated misconduct with a previous employer. "Misconduct" means any violation of the policies governing employee conduct at the applicant's previous place of employment, including, but not limited to, violations of policies prohibiting sexual harassment, sexual assault, or other forms of harassment, as defined by the employer. For reference, below are UC's policies addressing some forms of misconduct: UC Sexual Violence and Sexual Harassment Policy UC Anti-Discrimination Policy Abusive Conduct in the Workplace #J-18808-Ljbffr