Chief Information Security Officer

Chief Information Security OfficerThe Chief Information Security Officer (CISO) provides strategic leadership for Columbus State University's information security program, ensuring the confidentiality, integrity, and availability of institutional data and technology systems. Reporting to the Chief Information Officer, the CISO is a member of the UITS leadership team and serves a key role in University leadership. The CISO works closely with administration, academic leaders, faculty, staff, students, and the campus community to develop and deliver a comprehensive information security strategy aligned with the University System of Georgia (USG) IT Handbook and applicable state and federal regulations. The position leads governance, policy, compliance, risk management, incident response, and security awareness functions for the institution.Significant Duties & Responsibilities include: Strategic Security Leadership and Program Management (25%) - Provide strategic leadership for the University's information security program, including the development and execution of a multi-year security roadmap aligned with institutional priorities and the USG IT Handbook. Establish annual and long-range security goals, define strategy, develop maturity models, and create reporting metrics for continuous program improvement. Mentor security team members, advise the CIO and University Executive Leadership, and represent the University on committees and boards within USG and external consortia. Stay current on information security trends, regulatory developments, and threat landscape changes affecting higher education.; Policy, Compliance, and Audit Coordination (20%) - Lead the development, implementation, and ongoing maintenance of information security policies, standards, and procedures consistent with the USG IT Handbook, FERPA, GLBA (including the FTC Safeguards Rule), HIPAA, FISMA, PCI DSS, NIST 800-171 and CMMC where applicable, and GDPR. Coordinate IT and security audits, including scope definition, stakeholder engagement, timelines, and findings remediation. Partner with University Internal Audit, USG Cybersecurity, the Board of Regents Office of Internal Audit, the Compliance Office, and external assessors. Manage Georgia Open Records Act (GORA) requests in coordination with University Legal, USG Legal Affairs, and Human Resources, including document retrieval and review for legal privilege and confidentiality.; Risk Management and Incident Response (25%) - Develop, implement, and administer technical security standards and a portfolio of security services and tools to identify, mitigate, and monitor information security risk. Serve as the primary point of contact during significant security incidents, convene the Security Incident Response Team (SIRT), and lead breach response and notification activities in coordination with University Legal, USG Cybersecurity, Risk Management, and the Compliance Office. Evaluate the security implications of new technologies and establish review processes to ensure compliance with University standards. Maintain the institution's incident response, business continuity, and disaster recovery plans for information security functions.; Governance and Stakeholder Engagement (15%) - Manage institution-wide information security governance, chair the Information Security Governance Committee, and lead the UITS Information Security Team in establishing program priorities. Build and maintain relationships with academic and administrative leaders, deans, faculty, staff, and students. Provide guidance to the CIO and Executive Leadership Team on resource investments, technology decisions, and organizational risk posture. Engage with USG Cybersecurity, peer institutions, and regional and national consortia to share information and align practices.; Outreach, Education, and Training (15%) - Develop and deliver an enterprise security awareness, education, and training program for faculty, staff, students, and student employees. Advise operating units on security best practices, vulnerabilities, and emerging threats. Partner with academic units to support secure research environments, with student organizations to build a culture of security, and with external partners to advance community awareness around identity protection, mobile device security, and online safety.Required Qualifications include: Bachelor's degree in information security, computer science, information systems, or a related field required.; Minimum of five years of progressively responsible experience in information security, with at least two years in a supervisory or management capacity.; Experience securing enterprise systems and infrastructure required.; Industry-recognized security certification such as CISSP, CISM, or GIAC GSEC required.Proposed annualized salary range for this position is $111,068 - $123,451 and includes full benefits.