Chief Information Security Office (CISO)

Weyerhaeuser • Seattle, WA

3d • Onsite

About The Position

The Chief Information Security Officer (CISO), working in collaboration with Weyerhaeuser’s strategic initiatives, is an executive responsible for protecting our people, data, reputation, and manufacturing business operations by leading a business-aligned information security and cybersecurity program. This role sets the strategic direction for the security governance, risk management, incident response, third-party security, data protection, and security awareness programs. Operating as a trusted advisor to Weyerhaeuser’s executive leadership team, the CISO ensures the confidentiality, integrity, and availability of secure data while enabling innovation, responsible AI adoption and operational resilience. The CISO works closely with the business community and IT to provide objective risk oversight, policy leadership, executive reporting, and continuous improvement of Weyerhaeuser’s security posture. The CISO is responsible for creating a strategy to ensure our cybersecurity programs aligns with the company’s commitment to sustainability and operational resilience. The CISO is also responsible for identifying, evaluating and reporting on legal and regulatory, IT, and cybersecurity risk to information assets, while supporting and advancing business objectives. This role reports to the CIO who is accountable for enterprise IT, data, AI, and cyber security.

Requirements

• Bachelor’s degree in Information Security, Information Technology, Cybersecurity or related field
• Minimum of 15 years of progressive, relevant information security, cybersecurity or information technology leadership roles required
• 10+ years experience leading an information security team including advancing all security practices and programs
• Experience leading cybersecurity in a manufacturing environment including national and/or global distributed manufacturing field operation facilities is strongly preferred.
• Experience with Artificial Intelligence (AI) is strongly preferred
• Expert level skills with identity and access management, cloud security, vulnerability management, security operations and regulatory compliance required
• Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate information security and risk-related concepts to technical and nontechnical audiences at various hierarchical levels, ranging from board members to technical specialists
• Strong business acumen and expert level knowledge of information security risk management and cybersecurity technologies
• Up-to-date knowledge of methodologies and trends in manufacturing, threat intelligence (including AI) and emerging technologies
• Strategic critical thinker, with strong problem-solving and exceptional collaboration skills at all levels of the organization with the ability to plan, build and execute full scale security programs effectively
• Knowledge and understanding of relevant legal and regulatory requirements including Sarbanes-Oxley Act (SOX)
• Proven track record and experience in developing information security policies and procedures, as well as successfully executing programs that meet objectives in a dynamic manufacturing business environment
• Excellent analytical skills, the ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives
• Project management skills: financial/budget management, scheduling and resource management
• Ability to communicate the vision for, lead and motivate the information security team to achieve strategic goals in alignment with business objectives and risk measures
• Knowledge of common information security management frameworks, such as ISO/IEC 27001, ITIL, COBIT as well as those from NIST, including 800-53 and Cybersecurity Framework
• Demonstrated experience with contract and vendor negotiations
• Excellent stakeholder management skills including the ability to effectively collaborate, build trust and execute implementation of security solutions and programs across the enterprise
• High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of EQ, judgment and maturity
• High degree of initiative, dependability and ability to work autonomously while being resilient to change

Nice To Haves

• Professional security management certification preferred such as CISSP, CISM, CISA, CRISC, CCSP, HCISPP or other similar credentials

Responsibilities

• Develop an information security strategy that is aligned to growth initiatives, organizational priorities and enables achievement of the organization's business objectives while minimizing risks.
• Design, implement and manage a strategic, comprehensive information security program to ensure appropriate levels of confidentiality, integrity, availability, safety, privacy and recovery of information assets owned, controlled or/and processed by the organization.
• Align cybersecurity investments and priorities with enterprise risk appetite, regulatory demands, and business strategy.
• Serve as key advisor to Weyerhaeuser’s senior executives on cyber risk, emerging threats, and security-related business impacts.
• Translate technical security requirements into actionable business-focused plans across the enterprise.
• Monitor industry trends, threat intelligence, and emerging technologies to inform strategic direction.
• Drive the development and enforcement of enterprise-wide cybersecurity policies, standards, and frameworks.
• Ensure compliance with relevant legal and regulatory frameworks.
• Lead enterprise cybersecurity risk assessments and guide business units in risk treatment planning.
• Engage with internal audit, legal, finance, and compliance teams to manage regulatory obligations and audit readiness.
• Promote accountability and transparency through structured governance and reporting mechanisms.
• Provide leadership and strategic oversight for security engineering, infrastructure and application protection, and operations.
• Support adoption of secure architecture and development practices, including cloud and hybrid environments.
• Enhance our information security management framework based on the Institute of Standards and Technology (NIST) Cybersecurity Framework.
• Create and manage a unified and flexible control framework to integrate and normalize the wide variety and changing requirements resulting from global laws, standards and regulations.
• Develop and maintain a document framework of continuously up-to-date information security policies, standards and guidelines.
• Oversee the approval and publication of these information security policies and practices.
• Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the information security, and review it with stakeholders at the executive and board levels.
• Sits on the Architectural Counsel and ensures alignment between security and enterprise architectures ensuring that information security requirements are met and security is built in by design.

Benefits

• medical
• dental
• vision
• short and long-term disability
• life insurance
• pre-tax Health Savings Account option which includes a company contribution
• voluntary Long-Term Care
• Employee Assistance Programs
• personal volunteerism
• diversity networks
• mentoring
• training and development opportunities
• 401k plan
• paid company match in addition to our annual contribution equal to 5% of your base salary
• 3-weeks of paid vacation to use during your first year of employment
• paid holidays
• paid parental leave

What This Job Offers

• Job Type: Full-time
• Career Level: Executive