Director of Identity and Information Security

Position Title

Director of Identity and Information Security

Position Number

896570

Position Category

Administration

School/Division

ITS Information Security (division)

Department

ITS Information Security

Full-Time or Part-Time

Full-Time

Description

• Reporting to the Chief Information Officer (CIO), the Director of Identity and Information Security is a member of the ITS senior leadership team and works closely with the campus community, including academic and administrative departments. The Director is an advocate for the University’s security needs and is responsible for the development and delivery of a comprehensive security strategy that spans information security, identity and access management, and the technology underlying the University’s physical security systems.

• The Director leads the development and implementation of a security program that leverages collaborations and campus-wide resources, facilitates security governance, advises senior leadership on security direction and resource investments, and designs appropriate policies to manage security risk. The Director sets the University’s identity and access management strategy, including the Okta identity platform, and owns the strategy, configuration, and security of the University’s Lenel S2 access control system and related physical security technologies, in partnership with the Department of Public Safety, which manages day-to-day physical security operations and investigations.

• The complexity of this position requires a leadership approach that is engaging, imaginative, and collaborative, with a sophisticated ability to work with other leaders to set the best balance between security strategies and other priorities at the campus level.

Responsibilities include, but are not limited to:

Security Program Leadership

• Provides strategic leadership for the University’s identity and information security program, including identity and access management and the security of physical security technologies.
• Provides guidance and counsel to the CIO and key members of the University’s leadership team, working closely with senior administration, academic leaders, and the campus community in defining security objectives, while building relationships and goodwill.
• Manages institutional security governance processes.
• Leads security planning to establish an inclusive and comprehensive security program for the entire institution in support of academic, research, and administrative information systems and technology.
• Establishes annual and long-range security and compliance goals; defines security strategies, metrics, reporting mechanisms, and program services; and creates maturity models and a roadmap for continual program improvement.
• Stays current with security issues and regulatory changes affecting higher education at the state, national, and global levels, participates in policy and practice discussions, and communicates with the campus regularly about those topics.
• Leads the ITS Identity and Information Security team, builds strong working relationships with other teams, and brings groups together to share information and resources and make better decisions, policies, and practices for the University.
• Mentors Identity and Information Security team members and implements professional development plans for all members of the team.

Identity and Access Management

• Defines and leads the University’s identity and access management (IAM) strategy and roadmap, including the Okta identity platform, single sign-on, multi-factor authentication, and identity lifecycle management for students, faculty, staff, affiliates, and guests.
• Establishes standards and processes for identity lifecycle management, including provisioning, role changes, and deprovisioning, in partnership with Human Resources, the Registrar, Enterprise Systems, and other authoritative sources of identity data.
• Oversees access governance, including role-based access models, privileged access management, and periodic access reviews.
• Advances the adoption of strong, phishing-resistant authentication and zero trust principles across University systems.
• Guides the integration of Okta with enterprise and cloud applications, and with physical access credentials where appropriate, to provide a consistent and secure user experience.
• Monitors identity-related threats and ensures that IAM controls are measured, audited, and continually improved.

Physical Security Systems

• Owns the strategy, architecture, configuration, and security of the University’s Lenel S2 access control system and related physical security technologies, such as HID card readers and credentials.
• Partners with the Department of Public Safety, which manages day-to-day physical security operations and investigations, to align physical security technology with operational needs, policies, and emergency procedures.
• Establishes standards for physical access levels, credential issuance, and access reviews, and aligns physical access with identity lifecycle processes.
• Ensures that physical security systems are securely configured, segmented, patched, and monitored in accordance with University security standards.
• Collaborates with Facilities, Engagement and Client Support, and Digital Infrastructure on the installation and maintenance of access control systems and on renovation and construction projects.
• Evaluates and recommends physical security technologies and manages related vendor relationships.

Policy, Compliance, and Audit

• Participates in the development and implementation of effective and reasonable policies and practices to secure protected and sensitive data and ensure security and compliance with relevant legislation and legal interpretation, including policies for identity and physical access.
• Leads efforts to internally assess, evaluate, and make recommendations to management regarding the adequacy of the security controls for the University’s information, identity, and physical security systems.
• Works with Internal Audit, outside auditors, and other consultants as appropriate to complete security assessments and audits.
• Coordinates and tracks all information technology and security-related audits, including scope, units involved, timelines, participants, and outcomes. Works with auditors to keep audit focus in scope, maintain excellent relationships with audit entities, and provide a consistent perspective that puts the institution in its best light.
• Provides guidance, evaluation, and advocacy on audit responses.
• Works with University leadership and compliance department leadership to build cohesive security and compliance programs that effectively address applicable statutory and regulatory requirements.

Outreach, Education, and Training

• Works closely with other ITS leaders, technical experts, and academic and administrative leaders across campus on a wide variety of security issues that require an in-depth understanding of the IT environment in their units, as well as the research landscape and regulations that pertain to their research areas.
• Creates education and awareness programs and advises academic and administrative units on security issues, best practices, and vulnerabilities.
• Works with campus groups to build awareness and a sense of common purpose around security.
• Pursues student security initiatives that address unique