Chief Information Security Officer

Job Summary

Reporting to the Deputy CIO of Information Technology and as a member of the IT leadership team, the Chief Information Security Officer (CISO) is the lead advocate for the institution’s information and cyber security needs. The CISO is responsible for developing and overseeing a comprehensive information security strategy designed to protect the University’s information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction, and to ensure confidentiality, integrity, and availability for all campus resources.

Principal Duties and Responsibilities

• Provide guidance and counsel to the CIO and key members of the University leadership team regarding information security and privacy issues, risks, mitigation strategies, and information security governance.
• Develop a comprehensive information security program with annual and long‑range security and compliance goals, metrics, reporting mechanisms, and program services.
• Develop and lead outreach, communication, and user education efforts to promote campus‑wide information and cybersecurity awareness.
• Collaborate with IT leadership on incorporating information security throughout the technology life cycle, risk management, and audit compliance.
• Build positive relationships and foster goodwill toward efforts to improve overall security posture.
• Review hardware, software, and services being considered for purchase or implementation to assess potential security risks and ensure proper information security features are incorporated.
• Maintain integrity and appropriate confidentiality of information security related matters.
• Provide supervision for team resources, as well as budget development and management as needed.
• Develop, implement and oversee policies, standards and processes.
• Serve as the University’s primary point of contact in all audit, compliance, insurance, or legal matters related to information security.
• Keep abreast of changes to the State, Federal, and industry regulations that can impact University operations such as HIPAA, PCI‑DSS, EUGDPR, FERPA, Red Flags, and Gramm‑Leach‑Bliley.
• Make recommendations for changes or additions to university policies, procedures, or technology infrastructure to support compliance with these regulations from an information security perspective.
• Create ad‑hoc functional teams from among the various central and distributed IT units to research, recommend, and deploy new information security technologies or to implement changes to existing policies and procedures.
• Oversee IT security risk assessment processes and coordinate annual or periodic information security risk assessment reviews.
• Develop a roadmap to reduce high risks and sustain a well‑controlled environment to protect information assets.
• Oversee information security incident response, acting as incident coordinator and forming ad‑hoc incident response teams as necessary to respond to and recover from potential security incidents or data breaches.
• Communicate and coordinate with the Chief Information Officer and other campus leadership during incident response activities.
• Escalate incidents, when appropriate, to the executive team for determination of information security breach and notification.
• Coordinate contracted relationships with external security service providers for digital forensics investigations, e‑Discovery, or other sensitive data analysis as requested by IT management, Legal Counsel, Human Resources, or other University officials.
• Provide leadership in identifying, developing, implementing and maintaining information security awareness, and general and specialized training programs for the University.
• Recruit, hire, train and mentor the Information Security staff and implement professional development plans for all members of the team as needed.
• Oversee security operations related activities and manage the relationship with the MDR partner (Red Canary) including monthly review of reports and vulnerability mitigation strategies in the broader landscape.

Qualifications

• A Bachelor’s degree from an accredited college or university.
• Cyber security industry certifications from an established organization, such as SANS.
• Minimum of ten (10) years of progressively responsible IT experience with at least five (5) years of managerial experience.
• Professional experience designing, implementing, and/or managing information security policies, procedures, and solutions.
• Broad knowledge of computer security issues, requirements, and trends.
• Strong interpersonal and communication skills, and the ability to achieve goals through influence, collaboration, and cooperation.
• Demonstrated ability to work effectively with an array of constituencies in a diverse community.
• Experience providing education and training programs on security policies and practices to a range of technical and non‑technical constituents.
• Experience evaluating and providing guidance on the information security elements of software and hardware acquisitions, IT services, cloud‑based solutions, mobility, and other emerging aspects of IT solutions and services in a complex environment.
• Referenceable integrity and high standards of personal and professional conduct.
• Preferred:
• Master’s degree or other relevant formal education.
• Minimum five years of experience in a higher education IT environment.
• Ability to explain highly technical topics in terms that can be understood by a less technical audience.
• Strong organizational skills and a successful track record of effective coordination, prioritization, collaboration, and project delivery.
• Understanding of current legislation and regulations pertaining to higher education institutions (e.g., HIPAA, PCI‑DSS, EUGDPR, FERPA, Red Flags, and Gramm‑Leach‑Bliley).
• Professional activity by presenting at conferences and/or publishing or contributing to timely information security articles.

Compensation and Benefits

Salary Range: $195,000.00 – $206,000.00 annually. The position may also be eligible for comprehensive benefits, including health insurance, retirement plans, and tuition assistance.

Application Process

Applicants should submit a resume and cover letter describing how their background, skills, and education align with the needs of the University.

EEO/AA Statement

Montclair State University is an Equal Opportunity/Affirmative Action institution with a strong commitment to diversity.

Title IX and 34 C.F.R. 106 Policy

Montclair State is required by Title IX and 34 C.F.R. 106 not to discriminate on the basis of sex or gender and does not discriminate in the operation of education programs and activities, including admission and employment.