Information Security Officer

AllSTEM Connections; Topeka (KS); On-site; USD 95,000 - 140,000; Full time

Job summary

AllSTEM Connections is seeking a seasoned information security leader to develop and implement agency-wide security policies aligned with statewide standards. The role leads risk management and third-party evaluations and serves as the primary liaison with the Kansas Information Security Office.

You will conduct compliance assessments for CJIS, HIPAA, IRS Pub 1075 and guide IT projects with security best practices, coordinating incident response and staff training.

Qualifications

• Eleven (11) years of direct experience in information security.
• At least three (3) years of direct information security experience.
• Certifications or ability to obtain within one year.
• Familiarity with government/public sector environments.
• Knowledge of CJIS, HIPAA, IRS Pub 1075 and related regs.

Responsibilities

• Develop, implement, and maintain agency security policies and procedures aligned with KISO strategy.
• Lead risk assessments, mitigation planning, and third-party risk evaluations.
• Liaise between agency and KISO to implement statewide cybersecurity initiatives.
• Conduct compliance assessments and support audits for CJIS, HIPAA, IRS Pub 1075, etc.
• Collaborate with leadership and IT teams to integrate security into operations and projects.
• Coordinate incident response, containment, and root cause analysis.
• Provide security awareness training to agency staff.

Skills

NIST CSF knowledge

Policy development

Security strategy presentation

Leadership & PM

Regulatory assessment

Technical documentation reading

Education

CISSP/CISM/CISA certification

Public sector familiarity

Regulatory knowledge (CJIS/HIPAA/IRS Pub 1075)

Job description

• Develop, implement, and maintain agency-specific information security policies and procedures to ensure alignment with the Kansas Information Security Office (KISO) strategy and applicable laws, regulations, and frameworks (e.g., NIST CSF, NIST 800-53).
• Lead risk management activities including risk assessments, mitigation planning, and third-party/vendor risk evaluations to protect agency data, systems, and infrastructure.
• Serve as the primary liaison between the agency and KISO, communicating and implementing statewide cybersecurity initiatives while balancing agency-specific operational needs.
• Conduct compliance assessments and support audits related to federal, state, and contractual security requirements, including CJIS, HIPAA, IRS Pub 1075, and others.
• Collaborate with agency leadership and technical teams to provide strategic guidance and ensure security is integrated into all business operations and IT projects.
• Respond to security incidents by coordinating with internal and external stakeholders to manage investigation, containment, and recovery, followed by root cause analysis and improvement plans.
• Provide security awareness training and consultation to agency staff to promote a strong security culture and ensure understanding of security policies and practices.

Skills required:

• Strong working knowledge of security frameworks such as NIST CSF or NIST 800-53.
• Ability to develop and implement policies and procedures, and to present security strategies to both technical and non-technical audiences.
• Effective communication skills, with the ability to convey complex security concepts in simple terms to technical and business stakeholders.
• Strong leadership and project management skills, with the ability to prioritize tasks in a fast-paced environment.
• Ability to assess regulatory requirements and determine whether existing controls meet those requirements.
• Proficient in reading and comprehending technical information related to software, hardware, and telecommunications systems.

Experience required:

Eleven (11) years’ direct experience relative to the field of work, with at least three (3) years of direct experience in information security.

Education required:

• One or more cybersecurity certifications (CISSP, CISM, CISA) or must obtain within one year.
• Familiarity with government and public sector environments
• Knowledge of state and federal regulations such as CJIS, HIPAA, and IRS Pub 1075.