Enterprise Chief Information Security Officer

RSM US LLP; San Francisco (CA); On-site; USD 300,000 - 420,000; Full time

Job summary

RSM US LLP is seeking a Chief Information Security Officer to lead the organization’s global cybersecurity program, setting strategy, priorities, and execution across regions, markets, and functions. The CISO will advise executives and the board on material cyber risk and ensure risk management supports business outcomes.

This role leads distributed teams, governs risk and compliance activities, and guides crisis response, technology adoption, and regulatory alignment to strengthen our security

Qualifications

• Bachelor's degree or equivalent combination of education and experience.
• Ability to lead effectively through ambiguity and provide structure.
• Strong critical thinking, analytical, and problem-solving skills.
• 10 years' experience in a technology security role.
• 7 years' experience with legal, audit, compliance, and regulatory stakeholders.
• Subject matter expert in GLBA, GDPR, CCPA, ISO 27001, CMMC.
• Ability to articulate business imperatives and security impact.
• Excellent verbal, written, and interpersonal communication across all levels.
• Influence senior stakeholders across regions, cultures, and time zones.
• Experience setting global cybersecurity strategy, governance, and response plans.
• Experience leading enterprise cybersecurity strategy, governance, and data protection programs.

Responsibilities

• Set, communicate, and champion the global cybersecurity vision, strategy, and priorities.
• Advise executive leadership and board on material cyber risks and program effectiveness.
• Lead global cybersecurity crisis response for material incidents and regulatory inquiries.
• Establish and maintain cybersecurity governance for information ownership and protection.
• Guide secure adoption of emerging technologies and evolving cryptographic requirements.
• Oversee governance, risk, and compliance activities, including certifications and audits.
• Lead the maturity and resiliency of the cybersecurity function with an agile program.
• Build and enable high-performing global cybersecurity teams across regions.
• Develop leadership capability through standards, knowledge sharing, and succession readiness.
• Manage the cybersecurity budget and secure support for key initiatives.
• Establish metrics and governance forums to communicate program effectiveness and risk.
• Align cybersecurity requirements with technology and business decisions.
• Maintain external relationships with peers, regulators, and vendors.
• Support other strategic cybersecurity, risk, and leadership priorities as needed.

Skills

Leadership

Strategic thinking

Communication

Influence across stakeholders

Risk management

Cybersecurity expertise

Business alignment

Ambiguity handling

Education

Bachelor's degree or equivalent

CISSP/CISM certification preferred

Job description

We are the leading provider of professional services to the middle market globally, our purpose is to instill confidence in a world of change, empowering our clients and people to realize their full potential. Our exceptional people are the key to our unrivaled, culture and talent experience and our ability to be compelling to our clients. You'll find an environment that inspires and empowers you to thrive both personally and professionally. There's no one like you and that's why there's nowhere like RSM.

The Chief Information Security Officer (CISO) is responsible for the mission, vision, strategy, and execution of the organization's global cybersecurity program. The CISO serves as the senior global cybersecurity leader, accountable for setting enterprise priorities, advising executive and board stakeholders on material cyber risk, and ensuring cybersecurity risk management supports business outcomes across regions, markets, and functions.

This role leads through influence across cultures, jurisdictions, and business environments; establishes consistent global operating expectations; and guides coordinated strategy, execution, and response across distributed teams. The CISO partners with technology, operations, legal, compliance, and business leaders to protect information assets, maintain regulatory alignment, support client and business requirements, and strengthen the organization's global security posture.

Core responsibilities include:

• Set, communicate, and champion the global cybersecurity vision, strategy, and priorities, ensuring consistent direction and execution across regions while accounting for local regulatory, client, and business requirements.
• Advise executive leadership and board stakeholders on material cybersecurity risks, program effectiveness, risk-based investment decisions, and the business impact of security strategies, policies, and controls.
• Lead global cybersecurity crisis response for material incidents, regulatory inquiries, client requirements, and emerging risks, serving as the senior decision-maker for escalation, cross-border coordination, stakeholder alignment, and timely executive communications.
• Establish and maintain cybersecurity governance for information ownership, classification, protection, and risk-informed decision-making.
• Guide the secure adoption of emerging technologies and prepare the organization for evolving cybersecurity risks and cryptographic requirements.
• Oversee governance, risk, and compliance activities, including applicable certifications, regulatory requirements, industry standards, and significant third‑party and internal cybersecurity audits.
• Lead the continued maturity and resiliency of the cybersecurity function through an agile program that supports business objectives.
• Build, lead, coach, and enable high‑performing global cybersecurity teams by establishing clear operating models, decision rights, escalation paths, leadership routines, and accountability across distributed functions, regions, and time zones.
• Develop global cybersecurity leadership capability through consistent standards, knowledge sharing, inclusive leadership practices, and succession readiness.
• Manage the cybersecurity budget, establish priorities, and secure support for key initiatives.
• Establish metrics, reporting, and governance forums that communicate global cybersecurity program effectiveness, enterprise risk posture, regional considerations, and business value to executive and board stakeholders.
• Build alignment with technology and business leaders to incorporate cybersecurity requirements into organizational architecture and decision‑making.
• Maintain external relationships with global peers, partners, vendors, regulators, and industry groups to address shared cybersecurity risks, emerging trends, and cross‑border requirements.
• Support other strategic cybersecurity, risk, and leadership priorities as needed.

Minimum Qualifications:

• Bachelor's degree or equivalent combination of education and experience
• Ability to lead effectively through ambiguity and provide structure in complex, evolving situations
• Strong critical thinking, analytical, and problem‑solving skills, including the ability to analyze security requirements and align them to appropriate security controls
• 10 years' experience in a technology security role
• 7 years' experience working with legal, audit, compliance, and regulatory stakeholders in a global or multi‑jurisdictional environment
• Subject matter expert in applicable industry regulations, standards, and frameworks such as GLBA, GDPR, CCPA, ISO 27001, CMMC
• Ability to articulate business imperatives and the business impact of security tools, technologies, policies, and controls
• Excellent verbal, written, and interpersonal communication skills across all levels of the organization
• Ability to influence and advise technology, business, executive, and board stakeholders on cybersecurity strategy, risk, and business impact
• Demonstrated ability to lead, coach, and align distributed global teams; influence senior stakeholders across regions, cultures, and time zones; and drive enterprise‑wide outcomes without relying solely on direct authority
• Experience setting and executing global cybersecurity strategy, operating expectations, governance forums, leadership routines, decision‑making frameworks, and response plans across complex, matrixed, and highly regulated environments
• Experience leading enterprise cybersecurity strategy, governance, incident response, threat and vulnerability management, and data protection programs

Preferred Qualifications:

• CISSP, CISM, or similar information security certification preferred
• Master's or doctorate degree
• Experience developing cybersecurity talent, succession, and workforce capability strategies across distributed or global teams
• Experience supporting the secure adoption of emerging technologies and evolving cryptographic requirements

Additional Role Expectations:

• Travel: Up to 25%, including travel to support global team engagement, executive forums, client or regulatory matters, and critical incident response needs.
• Peak work periods and scheduling considerations: Additional availability outside standard business hours may be required to provide executive oversight, decision support, and global coordination across time zones during significant cybersecurity incidents, urgent risk matters, regulatory or certification activities, audits, global strategy cycles, executive reporting periods, and other time‑sensitive events.

At RSM, we offer a competitive benefits and compensation package for all our people.We offer flexibility in your schedule, empowering you to balance life's demands, while also maintaining your ability to serve clients.Learn more about our total rewards at https://rsmus.com/careers/working-at-rsm/benefits.

All applicants will receive consideration for employment as RSM does not tolerate discrimination and/or harassment based on race; color; creed; sincerely held religious beliefs, practices or observances; sex (including pregnancy or disabilities related to nursing); gender; sexual orientation; HIV Status; national origin; ancestry; familial or marital status; age; physical or mental disability; citizenship; political affiliation; medical condition (including family and medical leave); domestic violence victim status; past, current or prospective service in the US uniformed service; US Military/Veteran status; pre‑disposing genetic characteristics or any other characteristic protected under applicable federal, state or local law.

Accommodation for applicants with disabilities is available upon request in connection with the recruitment process and/or employment/partnership.RSM is committed to providing equal opportunity and reasonable accommodation for people with disabilities. If you require a reasonable accommodation to complete an application, interview, or otherwise participate in the recruiting process, please call us at 800-274-3978 or send us an email at [e-mail].

RSM will consider for employment qualified applicants with arrest or conviction records. For those living in California or applying to a position in California, please click here for additional information.