Chief Information Security, Compliance and Risk Officer/CISO

California State University, Fullerton•Fullerton, CA

2d•$6,891 - $22,119

About The Position

The Division of Information Technology (IT) at California State University, Fullerton (Cal State Fullerton) is seeking an exceptional individual to join its IT Information Security department as the Chief Information Security, Compliance and Risk Officer/CISO (Administrator III). The ideal candidate will possess a positive attitude, an active, energetic mind, and a leadership style characterized by highly ethical practices and a commitment to inclusivity, openness, flexibility, integrity, and kindness. This role is crucial for planning, developing, implementing, and monitoring the institutional information security, privacy, digital compliance, and cyber risk programs, overseeing the institutional cyber risk management, policy, and governance program. The CISO will collaborate with campus partners to establish security standards, coordinate audit responses, and manage third-party and cloud risks. The position also owns the cybersecurity incident response program, leads executive-level responses to high-impact incidents, and provides guidance for business continuity and disaster recovery. Furthermore, the CISO will establish and report on program effectiveness measures, direct campus-wide security, privacy, compliance, and risk awareness training, and represent the campus within the Cal State University (CSU) System on these matters. The role involves establishing and stewarding the multi-year vision, strategy, and capability roadmap for security, privacy, compliance, and risk, aligned with CSU systemwide policy, regulatory frameworks, and campus strategic priorities. The CISO will lead the Information Security and Compliance Office, focusing on workforce development and service delivery, and will build the office's multi-year resource forecast, including funding, staffing, and tools. The position handles highly confidential and sensitive institutional information and may participate in emergency or crisis-management activities. Other duties as assigned.

Requirements

Bachelor's degree from an accredited four-year college or university in computer science, information systems, cybersecurity, public administration, business administration, or a related field.
Eight or more years of progressively responsible experience in information security, cyber risk, or IT compliance, including significant leadership experience managing teams and programs.
Demonstrated experience setting strategic direction and roadmap for a cybersecurity, compliance, or risk program in a complex, multi-stakeholder environment.
Demonstrated knowledge of information security and privacy regulations and frameworks applicable to higher education (e.g., Family Educational Rights and Privacy Act (FERPA), Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act (GLBA), Payment Card Industry Data Security Standard (PCI DSS), California Consumer Privacy Act (CCPA), General Data Protection Regulation (GDPR), National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), NIST 800-53, International Organization for Standardization (ISO) 27001).
Experience leading or supporting cybersecurity incident response at an executive level, including coordination with legal, communications, and external partners.
Demonstrated ability to translate complex technical, policy, and regulatory concepts into clear guidance for executive leadership and non-technical audiences.
Strong interpersonal, written, and verbal communication skills, including the ability to facilitate cross-functional collaboration and build consensus.
A background check (including a criminal records check) must be completed satisfactorily.
Must file an initial “Conflict of Interest Form 700: Statement of Economic Interests” within thirty (30) days from date of hire and on an annual basis.
Must complete the CSU sponsored ethics on-line training within thirty (30) days of appointment, and at least once during each consecutive period of two calendar years following the appointment.
Must comply with the requirement outlined in CSU Executive Order 1083, revised July 21, 2017, as a limited mandated reporter under the California Child Abuse and Neglect Reporting Act.
Must complete CSA training.
Applicants will be required to disclose whether they have received a final administrative decision or final judicial decision determining that they have committed sexual harassment within the last 7 years only after a determination is made that they meet the minimum qualifications for the position, and before an offer of employment is extended.
Applicants who reach the final stages of the application process must also sign a release form that authorizes the release of information by the applicant’s current and/or former employers to the CSU concerning any substantiated allegations of misconduct.
Regular attendance is considered an essential job function.
May be required to successfully complete job-related performance test(s) as part of the selection process.

Nice To Haves

Master's degree in information assurance, cybersecurity, public administration, business administration, law, or a related field.
Professional certification(s) in one or more of the following: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Cybersecurity and Infrastructure Security Agency (CISA), Certified in Risk and Information Systems Control (CRISC), Certified in the Governance of Enterprise IT (CGEIT), Certified Information Privacy Professional (CIPP), Certified Information Privacy Manager (CIPM), Certified Data Privacy Solutions Engineer (CDPSE), or equivalent.
Experience working in higher education, particularly within the California State University (CSU) system or another large public university environment.
Direct experience serving as a CISO, Chief Privacy Officer, or equivalent senior executive in cybersecurity, compliance, or risk.
Experience with audit response and engagement with internal, external, and systemwide auditors.

Responsibilities

Planning, developing, implementing, and monitoring the institutional information security, privacy, digital compliance, and cyber risk programs.
Overseeing the institutional cyber risk management, policy, and governance program.
Collaborating with campus partners to establish campus security standards.
Coordinating audit responses and corrective actions.
Overseeing third-party and cloud risks.
Owning the cybersecurity incident response program.
Leading executive-level response to high-impact incidents.
Providing guidance for business continuity and disaster recovery.
Establishing and reporting meaningful measures of program effectiveness.
Directing campus-wide security, privacy, compliance, and risk awareness training and communication.
Serving as a campus representative to the Cal State University (CSU) System on matters related to information security, privacy, and accessibility.
Establishing and stewarding the multi-year vision, strategy, and capability roadmap for security, privacy, compliance, and risk across the University.
Leading the Information Security and Compliance Office, investing in workforce development and service delivery.
Building the office's multi-year resource forecast, including funding, staffing, and tools.
Handling highly confidential and sensitive institutional information.
Participating in emergency or crisis-management activities.
Filing an initial “Conflict of Interest Form 700: Statement of Economic Interests” within thirty (30) days from date of hire and on an annual basis.
Completing the CSU sponsored ethics on-line training within thirty (30) days of appointment, and at least once during each consecutive period of two calendar years following the appointment.
Complying with the requirements outlined in CSU Executive Order 1083, revised July 21, 2017, as a limited mandated reporter under the California Child Abuse and Neglect Reporting Act.
Reporting allegations of Clery Act Crimes as a Campus Security Authority (CSA).