Director of Information Security

Job title: Director of Information Security

About the Role Reporting to the CIO, the Director of Information Security is a member of the ITS senior leadership team and works closely with the campus community. The Director is an advocate for the University’s information security needs and is responsible for the development and delivery of a comprehensive information security strategy to optimize the information security posture of the University. The Director leads the development and implementation of a security program that leverages collaborations and campus-wide resources, facilitates information security governance, advises senior leadership on security direction and resource investments, and designs appropriate policies to manage information security risk.

What You'll Do

• Provide strategic leadership of the University’s information security program, guiding the CIO and key members of the University’s leadership team, working closely with senior administration, academic leaders, and the campus community in defining objectives for information security, while building relationships and goodwill.
• Manage institutional information security governance processes. Lead information security planning to establish an inclusive and comprehensive information security program for the entire institution in support of academic, research, and administrative information systems and technology.
• Establish annual and long-range security and compliance goals, define security strategies, metrics, reporting mechanisms and program services, and create maturity models and a roadmap for continual program improvements.
• Stay current with information security issues and regulatory changes affecting higher education at the state, national, and global levels. Participate in policy and practice discussions and communicate to campus on a regular basis about those topics. Engage in professional development to maintain continual growth in professional skills and knowledge essential to the position.
• Provide leadership philosophy for the ITS Information Security team (currently two staff, in addition to the director), create and maintaining strong working relationships with other teams, build respect for the contributions of all and bring groups together to share information and resources and create better decisions, policies, and practices for the University. Provide mentorship to Information Security team members and implement professional development plans for all members of the team.
• Policy, Compliance, and Audit: Participate in the development and implementation of effective and reasonable policies and practices to secure protected and sensitive data and ensure information security and compliance with relevant legislation and legal interpretation. Lead efforts to internally assess, evaluate and make recommendations to management regarding the adequacy of the security controls for the University’s information and technology systems. Work with Internal Audit, outside auditors, and other consultants as appropriate to complete security assessments and audits. Coordinate and track all information technology and security related audits including scope of audits, units involved, timelines, participants, and outcomes. Work with auditors as appropriate to keep audit focus in scope, maintain excellent relationships with audit entities and provide a consistent perspective that continually puts the institution in its best light. Provide guidance, evaluation, and advocacy on audit responses. Work with University leadership and relevant responsible compliance department leadership to build cohesive security and compliance programs for the University to effectively address applicable statutory and regulatory requirements.
• Outreach, Education, and Training: Work closely with other ITS leaders, technical experts, and academic and administrative leaders across campus on a wide variety of security issues that require an in-depth understanding of the IT environment in their units, as well as the research landscape and regulatory matters.
• Special projects and other duties as assigned.

What We're Looking For

• A strategic, collaborative leader with the ability to set security objectives, build governance structures, and balance information security needs with academic and administrative priorities.
• Experience developing and implementing an institution-wide information security program, including risk management, policy development, and metrics-driven governance.
• Knowledge of higher education regulatory environments and the ability to stay current with issues affecting the sector, with the ability to communicate effectively to campus leadership.
• Strong communication, mentorship, and cross-functional leadership skills with the ability to work with diverse stakeholders.
• Experience coordinating and responding to audits with internal and external auditors, and building cohesive security and compliance programs with university leadership.

Compensation & Benefits