Associate Director of Information Technology/Chief Information Security Officer

University of Arkansas System•Little Rock, AR

About The Position

The Chief Information Security Officer (CISO) is a key member of the CIO’s leadership team. Working closely with campus stakeholders, CISO advocates for information security within the University community, and is responsible for the development, delivery, and management of a comprehensive information security program that incorporates policies, procedures, and controls to effectively manage information security risk. This position is governed by state and federal laws, and agency/institution policy.

Requirements

Master of Science Degree in Cybersecurity
A minimum of five (5) years of experience leading an information security program, working with multiple government agencies as a physical and/or virtual CISO/DCISO, applying information security, risk management, and privacy practices in a regulated enterprise environment;
A minimum of three (3) years of experience in managing multiple teams
Three (3) years of practical experience working with information security laws and privacy regulations (e.g. PCI-DSS, FISMA, FERPA, HIPAA).
Strong knowledge of information security principles and best practices;
Strong knowledge of server, network, storage, telecommunication, and cloud technologies, including how information security relates to those technical domains;
Experience with information disaster recovery planning and testing, auditing, risk analysis, and business continuity planning;
Experience working in an interdisciplinary team environment, including effective influence management;
Effective relationship management, including dispute resolution skills;
Strong business acumen, analytical, and problem-solving skills;
Strong attention to detail;
Strong verbal and written communication skills, and presentation skills, which include the ability to communicate security and risk-related concepts to both technical and non-technical audiences;
Experience with ISO 2700x, NIST SP800-x, and/or information security frameworks.

Nice To Haves

A minimum of Five (5) years of experience in implementing intrusion detection and advanced measures, such as logging, firewalling, activity monitors, virus scanners, and other methods of information security practices, resulting in extensive data analysis and vulnerability management.
Experience in public higher education or state government information technology.
Familiarity with the following systems; Microsoft Active Directory, Microsoft Entra ID, Microsoft Defender, Microsoft Azure, Microsoft Intune, Lansweeper, PDQ Deploy, KnowBe4, and Tenable
Deep, practical knowledge of NIST Special Publications (e.g., SP 800-53, SP 800-171, and SP 800-37).
Ability to bridge technical security concepts with business objectives, manage incident updates, and report to senior management and boards of directors.
Knowledge of Arkansas state and federal information technology regulations.

Responsibilities

Work closely with university administration, academic leaders, and other campus stakeholders to define strategic objectives for information security, while building relationships and goodwill;
Work closely with IT Services department leadership to oversee the formation and operation of a university-wide information security program that effectively meets information security objectives at the lowest possible costs;
Implements intrusion detection and avoidance measures, such as logging, firewalling, activity monitors, virus scanners, or other intrusion detection methods.
Conduct Disaster Recovery simulations and tests to assure the campus has sufficient plans and procedures in place to successfully recovery of loss of functions on campus;
Coordinate with all critical stakeholders on campus (including procurement, public safety, communications, and senior staff);
Lead efforts to evaluate new security features including multi-factor authentication, end-to-end encryption, and firewall hardening;
Establish near-term, mid-term, and long-term information security and compliance goals;
Define metrics and reporting mechanisms to evaluate program effectiveness, including areas for improvement;
Stay abreast of information security issues and regulatory changes affecting higher education at the state and national level, and communicate those to the campus;
Engage in professional development to maintain continual growth in professional skills and knowledge essential to the position;
Provide guidance and counsel to the CIO and key members of the University’s leadership team on information security and/or regulatory topics
Work in collaboration with the University’s System Cyber Security Office on information security policies and data protection across the UA Little Rock campus.
Work in collaboration with the University of Arkansas System’s General Counsel to determine how information privacy and assurance law(s), regulation(s), and/or University policy apply to campus operations;
Work with auditors, as appropriate, to keep audit focus in scope, maintain excellent relationships with audit entities, and provide a consistent perspective that continually presents the institution in its best light;
Work with internal staff, outside consultants, University, and/or System leadership, as appropriate, on security assessments and audits. Provides guidance, evaluation, and advocacy on audit responses;
Lead the design and implementation of effective information security policies, procedures, and controls to meet compliance with applicable law(s), regulation(s), and/or University policy;
Create an information security awareness training program to build awareness and a sense of common purpose around security;
Educate IT Services technical staff and campus technical liaisons on security issues, best practices, and vulnerabilities;
Pursuing student security initiatives to build awareness such as identity theft, mobile social media security, and online reputation management;
Monitor the campus environment in collaboration with technical teams to identify and assess information security risk(s);
Develop, implement, and manage security standards and/or services to address and mitigate information security risk(s);
Examine new technologies to ensure they meet information security compliance objectives;
Lead security incident responses, including breach response/notification actions for the University;
Perform other duties as assigned.