Chief Information Security Officer

TX-HHSC-DSHS-DFPS•Austin, TX

29d•$10,271 - $16,853•Onsite

About The Position

This position is open to U.S. Citizens and permanent residents. This onsite role requires the selected candidate to work from an HHS office in Austin, Texas. The Texas Health and Human Services Commission (HHSC) is seeking an exceptional, forward-thinking Chief Information Security Officer (CISO) to lead cybersecurity for one of the largest and most mission-critical public-sector technology environments in Texas. This role is responsible for protecting public trust, supporting continuity of essential services, enabling secure modernization, and preparing the agency for emerging cyber threats, including artificial intelligence, cloud transformation, third-party risk, and post-quantum cryptography. The successful candidate will be a strategic security executive who can translate risk into business decisions, build strong partnerships across the organization, and lead a mature cybersecurity program that protects sensitive health, benefits, operational, and agency information throughout the HHS system. Reporting to the Chief Information Officer, the CISO provides executive leadership and oversight for the HHS information security program. The CISO also serves as the agency’s Designated Information Security Officer for HHS information resources, with authority to administer enterprise information security requirements, coordinate agency-wide security governance, and report cybersecurity risk and control effectiveness to executive-level management consistent with Texas Government Code §2063.401 and TAC Chapter 202. Additional responsibilities include cybersecurity strategy, governance, risk management, security operations, incident response, security architecture, policy development, awareness initiatives, and executive reporting. The CISO serves as a trusted advisor to executive leadership, business areas, technology teams, information owners, and agency partners. The position requires a collaborative leader who understands that effective cybersecurity enables, rather than impedes, the agency's mission. The CISO will advance cyber resilience, support secure modernization, strengthen identity and access management, promote zero trust principles, and drive risk-informed adoption of emerging technologies. The next HHSC CISO will: Build trust with executive leadership through clear, measurable, and actionable risk reporting. Lead a mature cybersecurity program focused on governance, accountability, and continuous improvement. Strengthen cyber resilience to ensure critical services remain available during and after cyber incidents. Prepare the agency for emerging threats through post-quantum readiness, modernization planning, and technology risk management. Partner with business and technology leaders to integrate security into strategic, operational, and procurement decisions. Develop a high-performing cybersecurity workforce and foster a culture of shared responsibility for security. Coordinate on behalf of the Health and Human Services enterprise with the Texas Cyber Command and other governmental entities, as appropriate.

Requirements

Extensive knowledge of enterprise cybersecurity strategy, governance, risk management, security operations, incident response, and applicable regulatory requirements in a large public-sector environment.
Extensive federal and state knowledge of cybersecurity frameworks and standards, including NIST guidance, Texas Administrative Code Chapter 202, the Texas Cybersecurity Framework, and risk-based security controls.
Knowledge of emerging cybersecurity trends and technologies, including post-quantum cryptography, zero trust architecture, cloud security, identity and access management, data protection, artificial intelligence security, and cyber resilience.
Knowledge of business continuity, disaster recovery, vendor management, contract oversight, and third-party technology risk management.
Skill in leading large, complex cybersecurity programs and developing enterprise security strategies, governance structures, policies, and measurable outcomes.
Skill in translating cybersecurity risks into actionable business decisions and communicating effectively with executives, technical staff, public officials, auditors, and other stakeholders.
Skill in building collaborative relationships and leading security assessments, risk analyses, incident response efforts, audits, and remediation activities.
Skill in managing large-scale initiatives, budgets, contracts, competing priorities, and developing high-performing cybersecurity teams.
Ability to provide visionary leadership, exercise sound judgment, and foster a proactive, risk-informed, and mission-focused security culture.
Ability to balance security, compliance, operational needs, modernization efforts, and user experience while implementing effective solutions to complex challenges.
Ability to anticipate and address emerging cybersecurity threats, including post-quantum risks, and maintain the security and integrity of critical systems.
Ability to exercise independent judgment, manage confidential information, and uphold the highest standards of ethics and professionalism.
Ability to maintain the security and integrity of critical infrastructure systems by preventing unauthorized access and ensuring compliance with laws and regulations related to national security and foreign ownership restrictions
Graduation from an accredited four-year college or university with major coursework in cybersecurity, computer science, information technology, management information systems, engineering, public administration, business administration, or a related field. Relevant senior-level experience may be considered as a substitution for education, consistent with HHSC Human Resources requirements.
At least 10 years of progressively responsible experience in cybersecurity, information security, technology risk management, security operations, enterprise technology leadership, or a closely related field.
Significant experience leading cybersecurity, information security, technology risk, or technical teams in a large, complex organization.
Experience advising executive leadership on cybersecurity strategy, risk, compliance, incident response, investment priorities, or enterprise security posture.
Experience with cybersecurity frameworks, regulatory compliance, audit coordination, risk management, or security governance in a public-sector, healthcare, financial, critical infrastructure, or similarly regulated environment.

Nice To Haves

Preference for professional certification such as: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), GIAC certification, or cloud security certification, or comparable advanced cybersecurity credentials.

Responsibilities

Enterprise Cybersecurity Leadership and Strategy — 25%: Provides executive leadership for the HHS cybersecurity program, establishing strategy, governance, priorities, and performance measures aligned with HHSC's mission, regulatory requirements, the Texas Cybersecurity Framework, and NIST guidance. Leads enterprise security initiatives, including cyber resilience, zero trust, cloud security, identity management, data protection, and post-quantum readiness. Advises executive leadership on cybersecurity risks, emerging threats, compliance, and investment priorities.
Information Security Governance, Risk, and Compliance — 25%: Directs the development and maintenance of enterprise security policies, standards, and controls. Ensures compliance with applicable state and federal cybersecurity requirements and integrates security into technology planning, procurement, operations, and third-party relationships. Leads risk management, audits, corrective actions, and executive reporting on security posture while ensuring stakeholders fulfill their information security responsibilities.
Cybersecurity Operations, Incident Response, and Resilience — 20%: Provides strategic oversight of cybersecurity operations, threat detection, vulnerability management, incident response, and cyber resilience capabilities. Ensures the agency can effectively prevent, respond to, and recover from cyber incidents while maintaining critical services. Promotes continuous improvement through performance metrics, exercises, lessons learned, and risk-based security investments.
Emerging Technology, Post-Quantum Readiness, and Secure Modernization — 15%: Leads enterprise cybersecurity efforts supporting emerging technologies, secure modernization, and post-quantum preparedness. Guides security architecture, cryptographic modernization, cloud security, artificial intelligence security, and secure technology adoption. Ensures security requirements are integrated throughout procurement, system development, implementation, and operations.
Workforce, Culture, and Stakeholder Engagement — 10%: Builds and develops a high-performing cybersecurity workforce and promotes a culture of accountability, collaboration, and continuous improvement. Oversees security awareness and training programs and represents HHS on cybersecurity matters with state agencies, business partners, and external stakeholders.
Budget, Contracts, Metrics, and Executive Visibility — 5%: Oversees cybersecurity budgets, contracts, resource planning, and performance measures. Communicates cybersecurity risks, priorities, and outcomes to executive leadership through metrics, reporting, and strategic recommendations.