Chief Information Security Officer (CISO)

State of West Virginia; Charleston (WV); On-site; USD 110,000 - 160,000; Full time

Benefits offered by this job

Health insurance

Retirement benefits

Paid holidays

Generous annual and sick leave

Job summary

The State of West Virginia seeks a Chief Information Security Officer (CISO) to lead the West Virginia Cybersecurity Office within the Office of Technology. The CISO is the state’s senior executive for enterprise cybersecurity and reports to the Chief Information Officer, with a direct advisory role to the Secretary of Administration and the Governor’s Office.

State law, updated in 2026, gives the CISO authority to set cybersecurity standards, direct risk assessments, and approve exceptions to

Qualifications

• Bachelor’s degree in cybersecurity, information technology, computer science, information systems, or a related field from an accredited institution. A master’s degree may substitute for two years of the general experience requirement.
• Ten years of progressive experience in information security or information technology risk management, including at least five years in a leadership role responsible for enterprise-level strategy, risk management, and team leadership.
• Experience developing and implementing enterprise cybersecurity policies, risk assessment programs, and incident response capabilities in a large organization.
• Experience with cybersecurity frameworks such as NIST CSF and NIST SP 800-53, and familiarity with data security requirements (IRS 1075, FBI CJIS, HIPAA)

Responsibilities

• Lead the enterprise cybersecurity program: set policies, standards, and the risk management framework; approve exceptions.
• Oversee annual cybersecurity program reviews with each agency and report posture to Governor and Legislature.
• Direct the Security Operations Center and coordinate statewide cyber incident responses.
• Run statewide cyber incident reporting for state agencies and local governments.
• Build security into modernization, procurement, and data governance.
• Manage cybersecurity vendors and contracts, including MDR, IR retainers, and security software subscriptions.

Skills

Leadership

Enterprise risk

Policy development

Executive communication

Governance

Education

Bachelor's degree in cybersecurity/related field

Master’s degree substitute for experience

Tools

SIEM

Vulnerability management

Digital forensics

Incident response tooling

Job description

Position Overview

The State of West Virginia seeks a Chief Information Security Officer (CISO) to lead the West Virginia Cybersecurity Office within the Office of Technology. The CISO is the state’s senior executive for enterprise cybersecurity and reports to the Chief Information Officer, with a direct advisory role to the Secretary of Administration and the Governor’s Office. State law, updated in 2026, gives the CISO authority to set cybersecurity standards for covered state agencies, direct their risk assessments, and approve exceptions to security policy. The Cybersecurity Office also receives cyber incident reports from state and local government entities across West Virginia. The CISO directly supervises three full-time employees and has 14 indirect reports.

Nature of Work

Position Overview

The State of West Virginia seeks a Chief Information Security Officer (CISO) to lead the West Virginia Cybersecurity Office within the Office of Technology. The CISO is the state’s senior executive for enterprise cybersecurity and reports to the Chief Information Officer, with a direct advisory role to the Secretary of Administration and the Governor’s Office. State law, updated in 2026, gives the CISO authority to set cybersecurity standards for covered state agencies, direct their risk assessments, and approve exceptions to security policy. The Cybersecurity Office also receives cyber incident reports from state and local government entities across West Virginia. The CISO directly supervises three full-time employees and has 14 indirect reports.

Examples of Work

Key Responsibilities

• Lead the enterprise cybersecurity program: set policies, standards, and the cyber risk management framework, and decide agency requests for exceptions.
• Oversee annual cybersecurity program reviews with each agency, and report on the state’s cybersecurity posture to the Governor and the Legislature.
• Direct the Security Operations Center (cyber monitoring, network and endpoint protection, vulnerability management, incident response, and digital forensics), run tabletop exercises, and coordinate the statewide response to significant cyber events.
• Run statewide cyber incident reporting for state agencies, local governments, county boards of education, and other covered public entities.
• Build security into technology modernization, procurement, and data governance, working with the CIO and agency IT leaders.
• Manage cybersecurity vendors and contracts, including managed detection and response, incident response retainers, and security software subscriptions: evaluate proposals, negotiate and oversee contracts, review new agency technology requests, and make funding recommendations.
• Oversee the AI Director, who reports to the CISO, and the state’s artificial intelligence security strategy and governance.
• Build partnerships with the federal Cybersecurity and Infrastructure Security Agency, the West Virginia Department of Homeland Security, the West Virginia Fusion Center, the West Virginia National Guard, the Board of Risk and Insurance Management, MS-ISAC, local governments, and higher education, and represent the state on privacy, security, and risk committees and advisory bodies.
• Recruit, develop, and retain the Cybersecurity Office team, and lead security awareness and training for users of state systems.
• Serve as the state’s primary contact for legislative, federal, and audit inquiries on cybersecurity, and brief executive leadership on risk, threats, and program needs.

Minimum Qualifications

• Bachelor’s degree in cybersecurity, information technology, computer science, information systems, or a related field from an accredited institution. Additional qualifying experience may substitute for the degree on a year-for-year basis. A master’s degree in a related field may substitute for two years of the general experience requirement.
• Ten (10) years of progressive experience in information security or information technology risk management, including at least five (5) years in a leadership role (such as CISO, Deputy CISO, Director of Cybersecurity, or an equivalent federal, military, or private-sector position) responsible for enterprise-level strategy, risk management, and team leadership.
• Demonstrated experience developing and implementing enterprise cybersecurity policies, risk assessment programs, and incident response capabilities in a large, complex organization (public or private sector).
• Experience applying cybersecurity frameworks such as the NIST Cybersecurity Framework and NIST SP 800-53, and familiarity with federal security requirements for data the state holds, such as IRS Publication 1075, the FBI CJIS Security Policy, and the HIPAA Security Rule.
• Proven ability to advise senior executives, build cross-organizational partnerships, and communicate complex risk concepts clearly.

Preferred Qualifications

• CISSP, CISM, Certified Information Systems Auditor (CISA), or equivalent certification, or willingness to obtain one within 12 months.
• Cybersecurity leadership in state or large local government, including multi-agency programs.
• Experience securing federated organizations and legacy systems during modernization, including asset inventory, cloud security, identity and access management, and zero-trust architecture.
• Experience managing security vendors and contracts, and familiarity with public-sector procurement law.
• A record of recruiting, developing, and retaining cybersecurity talent.
• Ability to obtain a federal security clearance.

Other Information

Benefits include health, dental, and vision insurance; retirement benefits; paid holidays; and generous annual and sick leave.

This is a full-time, in-office position based in Charleston, West Virginia. The position is classified-exempt, serves at the will and pleasure of the appointing authority, and is not covered by the state grievance procedure. As a condition of employment, the State will review job-related information, which may include criminal records, abuse registry records, driving records, employment history, and education and training. Failure to cooperate, false or incomplete information, or disqualifying information may result in denial of employment or dismissal. The State of West Virginia is an equal opportunity employer.

Job not in the classified service. See the hiring agency for a description of benefits.