Deputy Chief Information Security Officer

Touro University; New York (NY); Hybrid; USD 120,000 - 150,000; Full time

Job summary

Touro University is seeking a Deputy Chief Information Security Officer to lead the university-wide information security program across campuses and affiliates. You will serve as the acting CISO when required, guiding governance, risk management, and incident response to protect data on in-house and cloud systems.

The role requires strong leadership, regulatory knowledge (FERPA, HIPAA, GDPR, GLBA), and experience translating NIST CSF/RMF to business terms for senior leadership.

Qualifications

• Bachelor's degree required; major in information security preferred.
• Minimum five years of information security leadership in higher education.
• Ability to translate NIST CSF/RMF to business-friendly terms for senior leadership.
• Experience with security tools and incident response.

Responsibilities

• Act as acting CISO when required, ensuring leadership of Information Security and governance committees.
• Operationalize the Information Security strategy with leadership alignment.
• Lead enterprise incident response activities with coordination across stakeholders and vendors.
• Ensure proper documentation, evidence handling, post-incident reviews and remediation tracking.
• Manage daily information security operations: data protection, entitlement reviews, vulnerability management, monitoring and reporting.
• Ensure consistent security policies across campuses and systems; identify exceptions and compensating controls.
• Contribute to development, review and enforcement of security policies, standards, and procedures; align with FERPA, HIPAA, GDPR, GLBA and risk posture.
• Collaborate with CISO to maintain risk registers and mitigation strategies aligned with NIST CSF/RMF and privacy frameworks; map risks to HIPAA, FERPA, PCI DSS.

Skills

Information security leadership

NIST CSF/RMF translation

Regulatory compliance

Communication skills

Analytical thinking

Education

Bachelor's degree in Computer Science / MIS / Cybersecurity or related field

Five+ years in information security leadership in higher education

Tools

Email security tools

Vulnerability assessment tools

Incident reporting tools

Job description

Overview

Our top-notch Information Security team quickly finds and responds to real time threats. These critical thinkers have a hunger to keep ahead of new exploits and security trends. They protect the vast trove of valuable data that passes through our in house and cloud servers each day. As a part of the Information Security leadership team, you'll continue to uphold our reputation for integrity and protection of institutional data in this growing and ever-changing field. The Deputy Chief Information Security Officer (Deputy CISO) serves as the principal lead to the CISO and provides continuity of leadership for the Information Security program across all Touro University campuses and affiliates.

Responsibilities

Responsibilities include but are not limited to:

• Serve as acting CISO when required, ensuring uninterrupted leadership of the Information Security function, including representing Information Security on governance committees (eg, Information Security Steering Committee), and providing guidance to IT leadership, campus CIOs, Deputy CIOs, and senior administrators on security matters, as needed
• Operationalize the Information Security strategy, goals, and performance measures defined by the CISO through close collaboration and alignment with leadership priorities
• Lead enterprise incident response activities, ensuring:
  • Alignment with documented incident response (IR) procedures and regulatory obligations
  • Coordination with the CISO, internal stakeholders, third party vendors, cyber insurance carriers, and legal counsel during incidents
• Proper documentation, evidence handling, post incident reviews, and remediation tracking using institutional tools (eg, incident management platforms)
• Manage daily information security operations, including administration of security software tools associated with:
  • On-going review and continuous improvement of data protection programs, and processes
  • Entitlement review program and processes
  • Vulnerability management program and process
  • Security monitoring, logging, and review processes, including identifying and reviewing logs, creating playbooks, and producing reports that can be used to detect and deter unauthorized access that may be a threat to the university data, employee, and student security
• Ensure a consistent application of security policies across all campuses and systems, identifying exceptions and compensating controls, where necessary
• Contribute to and lead in the development, review, and enforcement of information security policies, standards, and procedures, ensuring alignment with regulatory requirements (FERPA, HIPAA, GDPR, GLBA, etc) and institutional risk posture
• In collaboration with the CISO, contribute to maintaining risk registers, control gap analysis, and mitigation strategies aligned with NIST CSF, NIST AI RMF and privacy frameworks; ensure risks, incorporate AI risks and all institutional risks are clearly mapped to HIPAA, FERPA, PCI DSS, and other regulatory obligations, with defensible documentation and audit-ready evidence

Qualifications

Education/Experience

• Bachelor's degree in Computer Science, Management Information Systems (MIS), Cybersecurity, or a closely related field required; major in Information Security preferred.
• Five or more years of relevant experience in information security in a higher education leadership role is required.
• Deep demonstrated knowledge of all aspects of Information Security domains and industry best practices associated with compliance frameworks.
• Ability to translate NIST CSF and NIST RMF to business-friendly, non-technical terms for communicating with Senior Leadership.
• Understanding and hands on use of tools that support information security (e.g., email security tools, vulnerability tools, incident reporting tools, etc.).

Knowledge/Skills/Abilities

• Excellent communication skills and detail oriented.
• Demonstrate knowledge and experience across a broad range of information security management technologies and processes, including identity provisioning, life cycle management, governance, separation of duties analysis, role management, access request systems, privileged access management, entitlement reviews, data loss prevention, firewalls, privacy, and incident response.
• Must possess analytical and critical thinking and problem-solving skillsets, including defining severity of issues and demonstrating appropriate escalation for resolution and identifying trends that warrant immediate attention.
• Must keep current with industry news and regulations, especially as they impact higher education.
• Maintain good (digital) citizenship, while upholding, enforcing and abiding by all institutional policies.
• Proficiency in Microsoft Office Suite including Word, Excel, Power Point, Outlook, Co-Pilot, Gemini+

Certifications/Licensures

• CISM or CISSP required and CISA certification, strongly desired.

Travel

• As needed to various Touro University Campuses.

Working Conditions

• Possibility of Flexible Work Arrangements including remote work opportunities.
• Extensive time sitting/working with computers.

Maximum Salary: USD $150,000.00/Yr.

Minimum Salary: USD $120,000.00/Yr.