Chief Information Security Officer

University of Baltimore • Baltimore, MD

2d • Hybrid

About The Position

Reporting to the Deputy CIO (DCIO), the Chief Information Security Officer (CISO) is a senior-level technical leader responsible for administering and managing UBalt’s information security architecture, strategy, policies, programs, and practices. The role protects the confidentiality, integrity, and availability of information assets from cyber threats and risks, maintains the integrity of campus technology resources, identifies and mitigates technology and information-related risks, and supports compliance with University System of Maryland (USM), state, and federal requirements.

The CISO oversees policy and standards development, security assessments, incident response, security awareness training, log management and monitoring, audit coordination, and intrusion detection and prevention systems. The position also provides analysis and consultation and participates in technology change management and procurement. This is a hybrid role requiring on-campus work at least one day per week, with the option to telework up to four days per week. Additional on-campus presence may be required periodically during the academic year to support university activities and operational needs.

Requirements

• Bachelor's degree in Computer Science, Information Technology Engineering, or a related field or discipline.
• Seven years of IT experience, including five years in information security administration and production support in a distributed networking environment.
• Familiarity with major information security tools.
• Experience with risk and vulnerability assessment and penetration testing.
• Experience working and interacting with technical teams.
• CISSP certification.
• Ability to provide 24/7 security incident support as needed.
• Analytical ability to conduct development and systems analysis, identify security threats and impacts, and gather and analyze data to make practical recommendations to leadership.
• Experience conducting security analysis, documenting information security processes, developing and assessing business cases for change, measuring security improvements, and participating in change management.
• Ability to adapt and sustain effectiveness while conditions and organizational structures may be fluid.
• Interpersonal, relationship-building, and communication skills, including presenting and speaking publicly and explaining complex security concepts in understandable terms.
• Ability to work with functional and technical teams and staff at all organizational levels and communicate clearly and accurately verbally and in writing.
• Knowledge of security and infrastructure technologies listed in the posting, including intrusion detection and prevention, SIEM, VPN, encryption, firewalls, networks, Cisco IOS, application gateways and load balancers, network scanning tools such as Nessus, wireless networking and 802.1x, operating systems, databases, cloud services, identity and directory services, and listed networking and communications protocols.

Nice To Haves

• Graduate degree in Computer Science, Information Technology Engineering, or a related field.
• Ten years of progressively responsible experience in information security administration and enterprise production support.
• Three years of experience in higher education.
• Experience with State of Maryland and USM audit processes.

Responsibilities

• Oversee, administer, and improve the University's information security program to protect information and technology systems.
• Monitor security trends and advocate for security practices, policies, and technology.
• Facilitate selection and implementation of security solutions, including antivirus and antimalware tools, firewalls, VPN, IPS, and SIEM.
• Participate in selecting IT infrastructure and software and develop security requirements.
• Lead the University's privacy initiative and maintain compliance with USM standards and guidelines.
• Analyze and correlate information from IPS and SIEM systems and oversee their ongoing maintenance and support.
• Lead the security incident response team, investigate detected or reported incidents, and report issues to OTS leadership or other personnel as appropriate.
• Develop and review automated reports to support compliance with USM policies, state and federal requirements, and audits.
• Review security advisories, assess their relevance and risk, and disseminate them to relevant technical staff.
• Prepare an annual IT security program update for the CIO and review it with the CIO for presentation to the President.
• Serve as the primary point of contact for IT-related audits and provide support and oversight for technology audits across campus units.
• Manage internal audits involving OTS, track resolution of audit findings, and provide periodic status updates to the CIO.
• Conduct network and server vulnerability assessments and routine network infrastructure configuration audits.
• Track security vulnerabilities and remediation activities and hold employees and leaders accountable for timely resolution.
• Partner with the Chief IT Architect on vendor security assessments.
• Lead and continually improve a personally identifiable information (PII) monitoring program.
• Oversee development and maintenance of the information security policy framework; identify policy needs and propose work to the DCIO and CIO.
• Develop information security policies, standards, guidelines, and procedures, and work with the Chief IT Architect on security architecture and standards.
• Review the policy framework periodically and monitor USM policies and Maryland legislation for requirements.
• Participate in the USM Privacy and Security Councils.
• Develop and maintain documentation for the security program and infrastructure; review other technology units' security documentation and recommend improvements.
• Provide periodic training to staff with backup information security responsibilities.
• Develop, implement, and maintain an ongoing IT security awareness program, working with Human Resources to provide appropriate training to faculty, staff, and students.
• Participate in technology change management and project teams, providing analysis to support successful changes and complete project requirements and plans.
• Serve on the technology Change Control Board (CCB) and participate in project evaluation teams to integrate security into the system development life cycle (SDLC).

Benefits

• Health, life, prescription, and dental plans.
• Tuition remission benefits.
• Paid leave: 22 days of annual leave, 15 days of sick leave, 3 days of personal leave, and 14–15 holidays.
• Retirement plans with employer contributions.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior