Chief Information Security Officer

Opt For Healthy Living; California (MO); Hybrid; USD 90,000 - 115,000; Full time

Job summary

CSU Channel Islands is seeking an Administrator II to lead the information security program, develop and enforce policies, and ensure regulatory compliance across university operations. The role will drive risk assessments, awareness training, and incident response coordination with CIO, ITS leadership, and university leadership.

The position requires a Bachelor's degree, 8–10 years in IT security/risk management, and leadership experience.

Qualifications

• Bachelor's degree is required; advanced degree preferred.
• Eight to ten years in IT Security, IT Risk Management, and General IT.
• At least four years in a leadership role.
• Certifications such as CISSP, CISM, or CISA are preferred.

Responsibilities

• Lead the University Information Security Program and policies.
• Develop security architecture, controls, and procedures.
• Provide regular assessments of security posture with metrics.
• Ensure compliance with CSU, state, and federal regulations.
• Coordinate education and training on information security and privacy.
• Oversee incident prevention and response processes.
• Act as campus contact for information security matters.

Skills

Leadership

Policy development

Risk management

Regulatory compliance

Education

Bachelor's degree

Advanced degree

CISSP

CISM

CISA

Job description

Job no: 561994
Work type: Management (MPP)
Location: Channel Islands
Categories: MPP, At-Will, Full Time, Information Systems & Technology, On-site (work in-person at business location)

Administrator II

RESPONSIBILITIES & DUTIES:

Recognized as the University Information Security, Risk, and Policy Officer (ISO/CRO/CPO) and is responsible for all duties assigned in that capacity. Maintains and administers the University Information Security Program and provides leadership in establishing and maintaining University security architecture, controls, policies, standards, processes, and procedures. Provides regular overall assessment of University security posture, operation of existing controls, and progress on improvements using metrics and reporting available to CIO, IT Leadership, and University Leadership. Performs activities required by CSU, federal, state, or other regulations to achieve or maintain University compliance. Provides an annual and scheduled review of University procedural documents related to information security, compliance, and risk management; maintains and administers the University Information Security Awareness Program; maintains and administers procedures and documentation supporting security, risk management and compliance. Collaborates with system-wide Information Security Council (ISC) on matters related to CSU system compliance and risk.

Policy: Coordinate the development of CSU Channel Islands information security policies, standards, and procedures. Work with key ITS offices, data custodians, and governance groups in the development of such policies. Ensure that university policies support compliance with system and external requirements. Oversee the dissemination of policies, standards, and procedures to the university community.

Education and Training: Coordinate the development and delivery of an education and training program on information security and privacy matters for employees, students, and other authorized users.

Compliance Enforcement: Serve as the university compliance officer with respect to CSU Channel Islands, state, and federal information security policies and regulations. Work with the campus designated FERP A, Records Access, and HIP AA privacy officers on compliance issues as necessary. Prepare and submit required reports to external agencies.

Risk Assessment and Mitigation: Develop and implement an ongoing risk assessment program targeting information security and privacy matters. Provide academic and business units with security risk assessments and provides or assist with the development, deployment, and monitoring of protective measures. Work with the CIO, appropriate IT committees, University executives, Deans, and top administrators in administrative departments and divisions to ascertain University security priorities. Work with the CIO to set a budget and advise on funding issues for identified priorities. Direct multiple complex security development projects and manages security systems so that the day-to-day IT functions of the University supporting teaching, learning, scholarship, and administration can work securely.

Incident Prevention and Response: Oversee the monitoring of security controls and provide metrics and reporting to ensure controls are performing as designed and action is taken to correct deficiencies. Develop, implement, and maintain an Incident Reporting and Response Process to address security incidents, breaches, policy violations, or complaints from external parties. Serve as the official campus contact point for information security, privacy, and copyright infringement incidents, including relationships with law enforcement entities.

Technical: Monitor and evaluate data from sources of security event information and/or network logs to promptly identify, evaluate, and respond appropriately to information security incidents that impact the information infrastructure at Channel Islands; provide regular assessments of Cl's information security operations to provide metrics of efficacy; may be called upon to mobilize and participate in incident handling on short notice during off-shift hours; contribute to the security systems design process; draft formal incident reports; contribute to the preparation of vulnerability reporting metrics, threat intelligence, and other analysis; interfaces with other key stakeholders to facilitate coordinated security operations; assist in security thought leadership activities to promote greater awareness of information security practices; conducts information security user awareness training as needed; other duties as required.

Customer Service: Work collaboratively with ITS staff to ensure proper enforcement of CSU and CI policies and practices regarding information security; work with end-users to assist with any information security-related issues and/or questions; work collaboratively with Cl's Procurement and Risk Management offices to enforce secure procurement practices of IT services and resources including contract review and analysis; provide consultative and training support to ensure user satisfaction and effective and secure use of university systems.

Teamwork: Participate as a member of the ITS team to ensure the successful operation of the entire work unit in supporting the security of university systems and meeting users' needs. Possess the ability to effectively communicate technical terms and requirements to functional users. Cooperatively work with ITS teams in support of the implementation of the CSU IC... 8000 Series Information Security policies.

Official Contact: Act as the designee representing Channel Islands on Information Security matters; serve as the campus contact point for external auditors and agencies, survey requests, etc. on security and privacy matters.

Other: Attends CSU system-wide meetings and represents ITS as required. Performs other duties as required.

REQUIREMENTS OF POSITION:

Bachelor's degree is required; advanced degree is preferred. Must have eight to ten years of experience in a combination IT Security, IT Risk Management, and General IT positions; with at least 4 years of this experience in a leadership role. Certifications such as CISSP (Certified Information System Security Professional), CISM (ISACA Certified Information Security Manager), or CISA (ISACA Certified Information Security Auditor) are preferred. Experience working in