Chief Information Security Officer (CISO) (C. E. A.)

Job Description and Duties Under the general direction of the Chief Information Officer (CIO), the Chief Information Security Officer (CISO) serves as a high level executive authority for cybersecurity policy, strategy, and IT security governance. The CISO provides high-level direction on cybersecurity risks and investments, advises executive leadership on statewide and departmental policy impacts, and ensures the confidentiality, integrity, and availability of STO’s information assets. The incumbent has broad responsibility for shaping and implementing long-range cybersecurity strategies and ensuring compliance with state and federal mandates. The CISO leads the information security program and exercises significant policy-making authority across all cybersecurity functions. This bulletin will run Until Filled with the cut off dates for review on the 27th of each month. You will find additional information about the job in the Duty Statement. Special Requirements • The position(s) require(s) a Background Investigation be cleared prior to being hired. Electronic applications are encouraged. If submitting a hard copy, please include JC-507504 / Position #820-760-7500-001 in the "Examination(s) or Job Title(s) for which you are applying" section of the application. Hard copy applications received without the required information may not be considered. Desirable Qualifications In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate: • Leadership experience in cybersecurity operations, including direct responsibility for incident response, risk management, security program governance, and cross-functional team collaboration with executive leadership, legal, procurement, and business units. • Demonstrated expertise in implementing and maintaining compliance with NIST Cybersecurity Framework (CSF), NIST SP 800-53, FIPS 199/200, and NIST Secure Software Development Framework (SSDF) in enterprise environments. • Broad technical experience with enterprise security platforms, SIEM solutions, XDR products, vulnerability management tools, network and cloud security technologies. • Experience leading enterprise-wide cybersecurity audits, privacy impact assessments, and regulatory compliance reviews with documented implementation of corrective actions. • Proven ability to develop and implement cybersecurity policies, standards, and governance frameworks that align with federal, state, and industry requirements. • Demonstrated experience in leading technology recovery/disaster recovery programs, chairing Change Advisory Board, and communicating complex cybersecurity risks, compliance requirements, information security contractual obligations, and strategic recommendations to executive leadership and non-technical stakeholders.