Chief Information Security Officer

Role Description

Under the general direction of the President, the CISO is responsible for the oversight, development, implementation, and maintenance of the Foundation’s security strategy and governance framework. The CISO ensures the confidentiality, integrity, and availability of digital assets, data, and IT infrastructure by proactively assessing threats and implementing security frameworks and architectures. This position focuses on risk management, policy enforcement, business continuity, incident response, and compliance with state/federal laws to protect Foundation data and assets. 

This role requires at least 3 days on-site.

Hiring Salary Range: $170,000 - $175,000

Responsibilities

• Manage the development and implementation of security policies, standards, guidelines, and procedures to ensure ongoing adherence to security standards, such as NIST. Coordinate the implementation and adherence of these requirements across all levels and programs at CFI.

• Manage the Security Office personnel by directing staff in their day-to-day assigned duties such as threat hunting, analysis of security events and incidents, validating compliance with the information security program and implementing changes that improve overall security. Develop, mentor and retain staff and ensure their skills are kept up to date as new threat vectors and technologies evolve.

• Lead the security architecture function, ensuring that all new and existing systems are designed with appropriate security controls and protocols.

• Direct enterprise-wide security risk assessments, gap analyses, and audits ensuring timely mitigation of identified vulnerabilities and risks. Work with outside consultants as appropriate for independent security and compliance audits.

• Work with the CFI Executive Team to recommend security and business continuity related expenditures for budgetary purposes that align with compliance requirements, identified business risks, and planned strategic initiatives.

• Develop and monitor the annual security budget.

Qualifications

• Bachelor’s degree in information security, computer science, information systems, or a related field is required. Master’s degree (MS, MBA, MPA) desired. 
• CISSP, CISA, GIAC, or CISM certification
• Candidates should possess strong Information Security and Information Security Management skills, including policy development, governance, risk management, and compliance oversight.
• Candidates should possess Cybersecurity and Application Security skills, including threat analysis, secure software practices, vulnerability management, and incident response.
• Candidates should possess Business Continuity skills, including disaster recovery planning, resilience strategy, and coordination of continuity testing.
• Demonstrated leadership experience managing cross-functional security initiatives and guiding technical and non-technical stakeholders is preferred.
• Strong communication, analytical, and decision-making skills, with the ability to present complex security topics to executive leadership and boards, are important.
• Ten (10) years of progressively responsible experience in cybersecurity and information technology, including at least 3 years in a senior leadership position.
• Proven experience in designing and managing enterprise-wide security programs, policies, and risk mitigation initiatives.
• Demonstrated experience in compliance, data privacy laws, risk management, incident response, and security frameworks
• Proven ability to interpret legislation, regulations, standards and guidelines.  
• Experience with business continuity planning, auditing and risk management, as well as contract and vendor negotiation/management.
• Ability to communicate security-related concepts to a broad range of technical and non-technical staff.
• Ability to build and maintain strong relationships with internal and external stakeholders at all levels in an organization.
• Ability to inspire and manage a high-performing team.
• Ability to handle high stress situations calmly and effectively.
• Ability to interpret and apply applicable laws, codes, regulations and standards.

Preferred:

• Working knowledge of NIST standards and guidelines. 
• Experience with direct cyber-security incidents.
• Experience transitioning from on-prem to cloud environments.

Physical Activities/Working Conditions:

• Extensive work with a PC
• Sitting for extended periods of time
• Walking, stooping, bending, pushing, grasping and standing as needed
•  Ability to infrequently lift or carry objects up to 25 lbs.

Company Description

Located in Raleigh, NC, College Foundation, Inc. (CFI), is a non-profit corporation serving North Carolina students and families since 1955. We administer education loan programs, several major grant and scholarship programs funded by the State of North Carolina for students attending North Carolina colleges and universities, and the tax-advantaged "529" college savings program on behalf of the North Carolina State Education Assistance Authority (NCSEAA). CFI also provides administrative support for College For North Carolina (CFNC), a free service of the State of North Carolina which promotes NC higher education and assists students with education planning, career planning and applying and paying for college.