Chief Information Security Office (CISO)

Weyerhaeuser•Seattle, WA

1d•$238,432 - $367,204

About The Position

At Weyerhaeuser, our IT team is on a mission to transform the timber industry. We are industry leaders in forest products and our customers are at the heart of everything we do. We’re not just in the cloud, we’re implementing technology that will keep us at the forefront of innovation in the forest products industry. We’re using AI to create new ways of bringing exciting products to our customers and we sustainably manage forests and manufacture products that make the world a better place. We’re serious about safety, driven to achieve excellence, and we proudly invest in the communities we are part of. With multiple business lines in locations across North America, we offer a range of exciting career opportunities for smart, talented people who are passionate about making a difference. The Chief Information Security Officer (CISO), working in collaboration with Weyerhaeuser’s strategic initiatives, is an executive responsible for protecting our people, data, reputation, and manufacturing business operations by leading a business-aligned information security and cybersecurity program. This role sets the strategic direction for the security governance, risk management, incident response, third-party security, data protection, and security awareness programs. Operating as a trusted advisor to Weyerhaeuser’s executive leadership team, the CISO ensures the confidentiality, integrity, and availability of secure data while enabling innovation, responsible AI adoption and operational resilience. The CISO works closely with the business community and IT to provide objective risk oversight, policy leadership, executive reporting, and continuous improvement of Weyerhaeuser’s security posture. The CISO is responsible for creating a strategy to ensure our cybersecurity programs aligns with the company’s commitment to sustainability and operational resilience. The CISO is also responsible for identifying, evaluating and reporting on legal and regulatory, IT, and cybersecurity risk to information assets, while supporting and advancing business objectives. This role reports to the CIO who is accountable for enterprise IT, data, AI, and cyber security.

Requirements

Bachelor’s degree in Information Security, Information Technology, Cybersecurity or related field
Minimum of 15 years of progressive, relevant information security, cybersecurity or information technology leadership roles required
10+ years experience leading an information security team including advancing all security practices and programs
Experience leading cybersecurity in a manufacturing environment including national and/or global distributed manufacturing field operation facilities is strongly preferred.
Experience with Artificial Intelligence (AI) is strongly preferred
Expert level skills with identity and access management, cloud security, vulnerability management, security operations and regulatory compliance required
Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate information security and risk-related concepts to technical and nontechnical audiences at various hierarchical levels, ranging from board members to technical specialists
Strategic leader who can effectively collaborate and communicate with and strategically influence executives and leaders across the organization in executing security methodologies, practices and policies
Strong business acumen and expert level knowledge of information security risk management and cybersecurity technologies
Up-to-date knowledge of methodologies and trends in manufacturing, threat intelligence (including AI) and emerging technologies
Strategic critical thinker, with strong problem-solving and exceptional collaboration skills at all levels of the organization with the ability to plan, build and execute full scale security programs effectively
Knowledge and understanding of relevant legal and regulatory requirements including Sarbanes-Oxley Act (SOX)
Proven track record and experience in developing information security policies and procedures, as well as successfully executing programs that meet objectives in a dynamic manufacturing business environment
Excellent analytical skills, the ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives
Project management skills: financial/budget management, scheduling and resource management
Ability to communicate the vision for, lead and motivate the information security team to achieve strategic goals in alignment with business objectives and risk measures
Professional security management certification preferred such as CISSP, CISM, CISA, CRISC, CCSP, HCISPP or other similar credentials
Knowledge of common information security management frameworks, such as ISO/IEC 27001, ITIL, COBIT as well as those from NIST, including 800-53 and Cybersecurity Framework
Demonstrated experience with contract and vendor negotiations
Excellent stakeholder management skills including the ability to effectively collaborate, build trust and execute implementation of security solutions and programs across the enterprise
High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of EQ, judgment and maturity
High degree of initiative, dependability and ability to work autonomously while being resilient to change

Responsibilities

Develop an information security strategy that is aligned to growth initiatives, organizational priorities and enables achievement of the organization's business objectives while minimizing risks.
Design, implement and manage a strategic, comprehensive information security program to ensure appropriate levels of confidentiality, integrity, availability, safety, privacy and recovery of information assets owned, controlled or/and processed by the organization.
Align cybersecurity investments and priorities with enterprise risk appetite, regulatory demands, and business strategy.
Serve as key advisor to Weyerhaeuser’s senior executives on cyber risk, emerging threats, and security-related business impacts.
Translate technical security requirements into actionable business-focused plans across the enterprise.
Monitor industry trends, threat intelligence, and emerging technologies to inform strategic direction.
Drive the development and enforcement of enterprise-wide cybersecurity policies, standards, and frameworks.
Ensure compliance with relevant legal and regulatory frameworks.
Lead enterprise cybersecurity risk assessments and guide business units in risk treatment planning.
Engage with internal audit, legal, finance, and compliance teams to manage regulatory obligations and audit readiness.
Promote accountability and transparency through structured governance and reporting mechanisms.
Provide leadership and strategic oversight for security engineering, infrastructure and application protection, and operations.
Support adoption of secure architecture and development practices, including cloud and hybrid environments.
Enhance our information security management framework based on the Institute of Standards and Technology (NIST) Cybersecurity Framework.
Create and manage a unified and flexible control framework to integrate and normalize the wide variety and changing requirements resulting from global laws, standards and regulations.
Develop and maintain a document framework of continuously up-to-date information security policies, standards and guidelines. Oversee the approval and publication of these information security policies and practices.
Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the information security, and review it with stakeholders at the executive and board levels.
Sits on the Architectural Counsel and ensures alignment between security and enterprise architectures ensuring that information security requirements are met and security is built in by design.