Description

Chancellor's Office Statement

Join our team at the California State University, Office of the Chancellor, and make a difference in providing access to higher education. We are currently seeking experienced candidates for the position of Chief Information Security Officer. The CSU Chancellor's Office, located on the waterfront adjacent to the Aquarium of the Pacific in downtown Long Beach, is the headquarters for the nation's largest and most diverse system of higher education. The CSU Chancellor's Office offers a premium benefit package that includes outstanding vacation, health, and dental plans; a fee waiver education program; membership in the California Public Employees Retirement System (PERS); and 14 paid holidays a year.

Salary

The salary range for this classification is $9,167 to $29,425 per month.

The anticipated salary hiring range is up to $18,750 per month, commensurate with qualifications and experience.

Classification

Administrator IV

Position Information

The California State University, Office of the Chancellor, is seeking a Chief Information Security Officer to provide vision, strategic innovation, transformative change, and strategic guidance on information security and privacy to the California State University and its 23 campuses. The Chief Information Security Officer is a leadership role that enables the CSU's academic, research, and public service mission (Student Success). The person in this office provides analysis, planning, and recommendations related to the management and security of the University's information assets, and works in close partnership with academic, business, and IT leadership teams to develop and deliver a comprehensive information security strategy, aligned with the University's privacy policies and objectives, to optimize the security posture of the system.

The complexity of this position requires a leadership approach that is engaging, imaginative, and collaborative, with a sophisticated ability to work with other leaders to set the best balance between security strategies and important priorities at the system and university levels.

Responsibilities

Under the general direction of the CIO, Information Technology Services, the Chief Information Security Officer will be:

Responsible for creating and implementing a CSU-wide Information Security Strategic Plan
Responsible for the development and management of system-wide policies, standards, guidelines, and procedures
Regulatory and statutory compliance management
Help inform the CO's approach to data privacy in conjunction with the Office of General Counsel, Finance, and Audit.
IT Procurement Security Reviews often for system-wide contracts and MEAs
Risk management
Information security awareness and training
Incident response management
Information asset management and access control
Security performance management
Manage system-wide information security governance process
Lead Information Security Management (ISM) team and implement professional development plans for all members of the team
Represent the CSU on committees and boards associated with the CSU in the state, national and regional consortiums, and collaborations.
Perform special projects and other duties as assigned

This person is the primary liaison from the Chancellor's Office to the campus communities on information management and security matters and is advised by system-wide information security governance committees, including the CSU Information Security Advisory Committee (ISAC). She/he serves as the CSU's primary point of contact for individuals and organizations on matters related to information management, security, and privacy protection. She/he communicates and collaborates with campuses, other divisions in the Chancellor's Office, other institutions, and government offices. Additionally, this person provides leadership and direction to a team of security professionals responsible for developing and maintaining the Chancellor's Office enterprise-wide information security program.

The Incumbent Will Manage The Following Tasks

Program Development and Management

Provide system-wide leadership and oversight for the University's information management, security, and privacy-related activities.
Develop, evaluate, and communicate short and long-term information security strategies aligned with established CSU goals.
Serve as an advisor to CO executive management, system-wide groups, and campuses on information management and security matters.
Provide guidance and advocacy regarding applicable federal/state laws, industry regulations, best practices, and prioritization of infrastructure investments that impact information management and security.
Develop, implement, and manage information management and security programs that ensure the integrity, confidentiality, and availability of information assets owned or entrusted to the CSU. Revise the plan as necessary to comply with changes in applicable CSU policies, laws, or industry regulations.
Monitor and report on CSU information security activities and compliance.
Represent the CSU's information security and privacy interests to appropriate constituents, third parties, and other officials.
Chair the system-wide information security advisory governance group.
Provide CSU representation on Cradle to Career advisory committee.
Serve as a liaison between constituents and audit, Office of General Council (OGC), Risk Management, and HR management teams as required.

Policy Development and Management

Collaborate with system-wide and campus stakeholders, data owners, and governance groups in the development and implementation of system-wide information management, security, and support privacy protection policies, standards, and guidelines that are aligned with the academic mission and business needs of the CSU.

Risk Management

Implement an ongoing CSU information security risk assessment program, which will identify and classify critical information assets, assess threats and vulnerabilities regarding those assets, and implement safeguard recommendations through various technical and policy initiatives.
Identify key CSU security risks and recommend methods for vulnerability detection and remediation and oversee vulnerability testing for the CO.
Collaborate with the campuses to mitigate this risk through various technical and policy initiatives and training.
Collaborate with executive leadership and IT audit to determine acceptable levels of risk for the organization and to implement practices that meet defined policies and standards for information security.
Serve as primary liaison with cyber insurance carriers and underwriters.
Provide regular reporting to CSU executive management on system-wide risk and mitigation efforts.

Incident Management

Develop and manage the CSU information security incident management program that responds to incidents involving critical, sensitive, or confidential information assets.
Lead investigations into information security incidents and recommend corrective actions to minimize harm and make recommendations to management for corrective action.
Serve as the official CO contact point for information security and privacy incidents and keep the CIO and CO team informed of such incidents and any mitigation actions.
Review security breach notifications authored by each campus.

Communication and Collaboration

Foster a collaborative approach to information security efforts across the CSU. For example:
Work with CSU General Counsel on legal, regulatory, and policy compliance matters.
Work with CSU Human Resources on privacy protection and personal security matters.
Work with Purchasing and Contracts to ensure that any necessary data management and information security language is included in contracts and agreements.
Assist CSU Internal Audit in developing appropriate criteria to assess CO and campus compliance with applicable laws, regulations, and CSU policies and standards.
Leverage existing processes, groups, or forums or create new ones to ensure the CSU community can provide appropriate input and influence over information management and security directions.
Facilitate the sharing of information management and security best practices across the CSU.

Compliance Management

Serve as the CSU compliance officer concerning CSU information security, privacy and data protection policies, and applicable state/federal regulations.
Keep abreast of the latest federal/state and international data management, information security, and privacy protection legislation, regulations, advisories, alerts, and vulnerabilities that may apply to the CSU.
Collaborate with system-wide and campus-designated privacy officers, risk management, human resources, audit, legal counsel, and other stakeholders to ensure compliance with CSU, state and federal data management, information security, and privacy protection regulation and laws.
Cooperate with external and internal audits, law enforcement, and regulatory groups in compliance reviews and investigations.

Consulting Services

Provide information and security consulting to significant applications initiatives, and participate in the system development cycle to help ensure that security issues are considered and addressed early.
Assist in reviewing applications and technology environments during the development or acquisition process to ensure compliance with university security policies and directions.
Collaborate with project sponsors to ensure partner and business associate agreements include security and privacy requirements and responsibilities and address all related concerns.

Security Awareness and Training Program Management

Coordinate developing, implementing, and operating various training and communication initiatives, including a system-wide information security awareness training program.
Oversee and ensure the development of ongoing system-wide security and privacy protection training, awareness activities, and communications for personnel at all levels.

Technical Security Management

Maintain familiarity with the CSU technical infrastructure and promote the use of information security and privacy-enhancing technologies.
Provides strategic and tactical guidance for projects involving critical assets or confidential/sensitive information.
Research and evaluate procedural, technical, and administrative solutions that provide detection, prevention, containment, and deterrence mechanisms to protect and maintain the integrity of campus data, infrastructure, systems, applications, and physical assets.
Collaborate with CO and campus IT staff to establish and implement integrated IT management solutions.

Security Performance Management

Establish measures, metrics, thresholds, and targets to drive and measure the effectiveness of data management, information security, and privacy protection policies and controls.

Manage the CO Information Security Program

Provide oversight to a team responsible for the Chancellor's Office information security program.
Responsibilities of the CO's information security management team include but are not limited to the following:
Development of policies, standards, procedures, and guidelines
Risk management
Compliance with applicable laws, regulations, and CSU policies and standards
Information security training and awareness program
Incident management
Tactical operations
Security administration (e.g., access reviews)
Collaboration and coordination with CO staff on matters related to information security.
Establish measurable individual and team objectives that are aligned with departmental and enterprise-wide goals.
Ensure staff has the resources and skills needed to support all work initiatives
Develop the departmental strategic goals, multi-year operating plans, and operating budget.

Qualifications

This position requires:

A bachelor's degree in a related field, or an equivalent combination of education and related experience, is required.
Minimum of 12 years of experience in a combination of risk management, information security administration, and IT administration is required.
Five (5) plus years of experience at a senior management level in a complex IT organization encompassing service delivery, application development, and IT infrastructure is required.
Leadership and strong management background is required.
Some travel is required.

Preferred Qualifications

Graduate degree preferred
Information Security related certifications are highly desirable (CISSP, CISM, CISA, GIAC, etc.) is highly desirable.
Knowledge of common information security management frameworks, such as ISO/IEC 27001 and NIST is highly desirable.
Professional security management certification is highly desirable.
Comprehensive knowledge of project control techniques, including milestone and critical path scheduling, budget analysis, and variance reporting, is highly desirable.
Advanced skills in the use of information technology are highly desirable.
Experience developing, managing, or advocating data management, information security, or privacy protection strategies, plans, policies, or operating procedures is highly desirable.
Experience as a campus information security officer is highly desirable.
Knowledge of higher education practices and operations are highly desirable.
This person must possess excellent written and oral communication skills and management skills highly desirable.
Experience working in an organization with matrix reporting relationships and integrated, cross functional work teams is preferred.

Application Period

Priority consideration will be given to candidates who apply by May 8, 2023. Applications will be accepted until the job posting is removed.

How To Apply

Please click "Apply Now" to complete the California State University, Chancellor's Office online employment application.

Equal Employment Opportunity

The university is an Equal Opportunity Employer and does not discriminate against persons on the basis of race, religion, color, ancestry, age, disability, genetic information, gender, gender identity, gender expression, marital status, medical condition, National origin, sex, sexual orientation, covered veteran status, or any other protected status. Reasonable accommodations will be provided for qualified applicants with disabilities who self-disclose by contacting the Senior Human Resources Manager at (562) 951-4070.

Title IX

Please view the Notice of Non-Discrimination on the Basis of Gender or Sex and Contact Information for Title IX Coordinator at: https://www2.calstate.edu/titleix

E-Verify

This position requires new hire employment verification to be processed through the E-Verify program administered by the Department of Homeland Security, U.S. Citizenship and Immigration Services (DHSUSCIS)' in partnership with the Social Security Administration (SSA).

If hired, you will be required to furnish proof that you are legally authorized to work in the United States.

COVID19 Vaccination Requirement

The CSU requires faculty, staff, and students who are accessing campus facilities to be fully vaccinated against COVID-19 or declare a medical or religious exemption. Any candidates advanced in a currently open search process should be prepared to comply with this requirement as a condition of employment. The systemwide policy can be found at https://calstate.policystat.com/policy/9779821/latest/

Mandated Reporter Per CANRA

The person holding this position is considered a 'mandated reporter' under the California Child Abuse and Neglect Reporting Act and is required to comply with the requirements set forth in CSU Executive Order 1083 as a condition of employment.

Conflict of Interest

The duties of this position will include participation in decisions that may have a material financial benefit to the incumbent. Therefore, the selected candidate will be required to file Conflict of Interest Form 700: Statement of Economic Interest when they first occupy the position, and on an annual basis, complete ethics training within 6 months of appointment, and attend this training every other year thereafter.

Background

The Chancellor's Office policy requires that the selected candidate successfully complete a full background check (including a criminal records check) prior to assuming this position.

Closing Date/Time: Open until filled

California State University, Office of the Chancellor

New Jobs

Chief Information Security Officer (526565)