Chief Information Security Officer

Job Description and Duties

Under administrative direction of the Department's Chief Information Officer, the Information Technology Manager II (ITM II) serves as the Department's Chief Information Security Officer (CISO) and Department AI Cybersecurity Officer. The CISO is the executive responsible for establishing and directing the Department's enterprise information security, cybersecurity, privacy coordination, data protection, risk and compliance, security architecture and engineering, security operations, technology recovery, and artificial intelligence security programs. The CISO is responsible for establishing and enforcing enterprise information security policies, driving long-range security strategies, and overseeing the Information Security Branch to ensure alignment with the Department’s IT strategic direction. The position provides expert leadership in risk management, threat mitigation, vulnerability assessments, security incident investigation, security compliance, security architecture planning, disaster recovery, and security agreements with external partners supporting our programs in Headquarters, the 21 regional centers, and state-operated facilities. The CISO maintains enterprise accountability for safeguarding the Department’s IT infrastructure, networks, devices, and data, ensuring the confidentiality, integrity, and availability of critical information assets. This includes developing and maintaining policies and controls necessary to protect Protected Health Information (PHI) and Personally Identifiable Information (PII) for more than five hundred thousand individuals served across highly complex applications, 21 regional centers, state-operated facilities, and over 29,000 community service providers .

This recruitment is being conducted in anticipation of budget approval. Final hiring is contingent upon approval of funding. 

Effective July 1, 2025, State employees are subject to a salary reduction of three percent in exchange for five hours per month of the Personal Leave.

Please let us know how you heard about our position by taking this brief survey:

You will find additional information about the job in the .

Working Conditions

Open-spaced partitioned offices. Prolonged periods utilizing a computer most of the time. Occasional travel including overnight or day trips for covered California locations. May require 24/7 on-call support as well as weekend support responsibility.

Under Government Code 14200, this position is a hybrid, in-office/telework position, and may be subject to change. Incumbent can be required to report to the office, or any designated location at any time. Telework agreements can be modified and/or cancelled at any time. All commute expenses to the reporting location will be the responsibility of the selected candidate.

Pursuant to California Government Code requirements, candidates must be residents of the State of California at the time of appointment.

This position requires lawful authorization to work in the United States. The Department does not sponsor employment visas for this position.

Special Requirements

If you are using list eligibility from an on-line exam to qualify for this position, you MUST include with your application any documentation (i.e., copy of transcript, degree, license, etc.) to verify meeting the MQ’s or you may not be considered for the position.

The MQs will be verified prior to interview and/or appointment. If it is determined that an applicant does not meet the MQs of the classification, the applicant may not be considered and withheld from the eligible list.

Desirable Qualifications

In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:

Knowledge of: Enterprise information security principles, frameworks, and practices, including security governance, risk management, incident response, vulnerability management, and security architecture; service-oriented and event-driven architecture, systems design, technology integration, and infrastructure platforms/protocols; IT project management methodologies, research and development approaches, IT service management, and organizational change management; regulatory and compliance requirements, including HIPAA, SOX, PCI, NIST, GLBA, CMS, and SSA directives, and how these requirements apply within large public-sector environments; data privacy laws, practices, and safeguards, including secure data acquisition, protection, transmission, retention, and disposal; organization and functions of California State Government, including its policies, principles, and governance structures; technical concepts across major IT domains such as networking, applications, databases, operating systems, cloud platforms, identity management, and endpoint protection; international, federal, state, and local laws governing data security and privacy; enterprise IT disciplines and how they interrelate (infrastructure, servers, networks, databases, applications, security operations, etc.) to support business missions.

Ability to: Lead and manage enterprise information security programs, including policy development, risk assessment, incident response, and compliance oversight; develop strategic plans, aligning security initiatives with organizational priorities, and translating complex security requirements into actionable operational activities; supervise, mentor, and develop technical and managerial staff, fostering teamwork, accountability, professional growth, and continuous improvement; analyze, problem-solve, and evaluate complex technical environments, identify risks, and recommend effective mitigation strategies; communicate clearly and effectively with executive leadership, program staff, and technical teams, including the ability to explain complex security concepts to non-technical audiences; evaluate, select, and implement security technologies, tools, and platforms to strengthen enterprise security posture; manage large-scale security projects and initiatives, including timelines, resources, dependencies, and change management; conduct and oversee security assessments, audits, and reviews using automated tools, documentation analysis, and stakeholder interviews; interpret and apply federal and state laws, regulations, and standards governing information security and privacy; build partnerships with program leaders, regional centers, external partners, and state oversight entities to align security expectations and drive compliance; develop and maintain disaster recovery and technology contingency plans, including conducting business impact analyses and coordinating recovery exercises; negotiate, coordinate, and manage vendor relationships related to security products, services, and third-party compliance requirements; oversee and ensure proper handling, protection, and transmission of sensitive and confidential data across complex distributed environments.

Benefits

As a state employee working for the Department of Developmental Services, you and your family will have access to excellent medical, dental and vision insurance benefits in addition to retirement benefits.

Benefit eligibility may be based on job classification, bargaining unit, time base and length of appointment. Additional benefits may also be outlined for specific bargaining units in employee collective bargaining contracts. For more information, please visit the links below:

Benefit information can be found on the website and the website.

Additional Information

Electronic application submission is highly encouraged.

Multiple positions may be filled from this recruitment. This recruitment may be utilized to fill future vacancies that may occur during the life of the certification list.

Possession of Minimum Qualifications will be verified prior to interview and/or appointment. If you are meeting Minimum Qualifications with education, you must include your unofficial transcripts/diploma for verification. Official transcripts may be required upon appointment. If it is determined an applicant does not meet the Minimum Qualifications, the candidate may be withheld from the eligibility list, rendering them inactive and ineligible to be hired for the position. Candidates who have been withheld may file an appeal with the California Department of Human Resources.

All appointments are subject to State Restriction of Appointment (SROA), Departmental Restriction of Appointment (DROA), Re-employment List procedures, pre-employment physical and fingerprint clearances. Further information on the definition of the above may be found on the California Department of Human Resources' website at:

If you have not taken the Information Technology Manager II exam/assessment you may find the exam for this classification at the link below. You must take and pass the exam/assessment to obtain eligibility for hire. Click to gain list eligibility.

Required Application Package Documents

The following items are required to be submitted with your application. Applicants who do not submit the required items timely may not be considered for this job:

• Current version of the State Examination/Employment Application STD Form 678 (when not applying electronically), or the Electronic State Employment Application through your Applicant Account at All Experience and Education relating to the Minimum Qualifications listed on the Classification Specification should be included to demonstrate how you meet the Minimum Qualifications for the position.
• Resume is optional. It may be included, but is not required.