CISO Advisory Consultant

CISO-Level Advisory Consultant

We are seeking a CISO-level Advisory Consultant to lead a short-term, high-impact engagement focused on evaluating and advancing the cybersecurity capability of a complex healthcare and academic medical center environment. The ideal candidate brings both strategic and operational leadership experience in cybersecurity, with a proven track record of delivering board-level insights, workforce assessments, and actionable security improvement plans.

Key responsibilities include leading a comprehensive current-state assessment of cybersecurity operations, workforce structure, and domain coverage; benchmarking capabilities using industry frameworks; identifying skill and leadership gaps, domain blind spots, and structural misalignments; developing visual tools such as capability heat maps and role-based maturity matrices; crafting a strategic security talent roadmap aligned to organizational risk posture and regulatory context; delivering an executive summary and board-ready narrative; and facilitating workshops, executive sessions, and validation meetings with stakeholders across IT, clinical, research, and governance domains.

Ideal qualifications include 15+ years in cybersecurity leadership, with at least 5 in CISO or Deputy CISO-level roles; deep familiarity with healthcare, academic medical centers, or similarly regulated/high-complexity environments; proven experience conducting cybersecurity organizational assessments and delivering strategic planning outcomes; executive-level communication and presentation skills; strong working knowledge of industry standards and frameworks (NIST, CIS, MITRE, NICE); experience collaborating with both internal and third-party stakeholders (MSSPs, consultants, internal IT/security); and prior consulting, advisory, or fractional-CISO experience strongly preferred.

Deliverables may include capability summary and benchmarking visuals, maturity & gap analysis report, talent heat map and skill assessment by role, strategic roadmap and hiring/upskilling recommendations, executive briefing deck or board summary, and optional cyber resilience readiness summary and workshop output documentation.