Chief Information Security Office

Kleinfelder Inc•Boston, MA

3h•$182,548 - $275,000

About The Position

The Chief Information Security Officer (CISO) is the enterprise executive accountable for the organization’s cybersecurity, information risk, privacy-supporting security, and cyber resilience program. The CISO establishes strategy, governance, architecture, and operating priorities to protect the organization, its clients, regulated data, intellectual property, and business operations while enabling growth, digital transformation, cloud adoption, artificial intelligence, and secure technology-enabled services. The CISO advises executive leadership and the Board on material cyber risk, regulatory and contractual obligations, threat conditions, investment priorities, and risk acceptance. The role leads enterprise security, coordinates incident readiness and response, and partners across Information Technology, Legal, Privacy, Human Resources, Internal Audit, Procurement, Operations, and business leadership. The CISO also provides executive sponsorship for secure-by-design and DevSecOps practices and federal compliance programs, including CUI, FCI, NIST SP 800-171, DFARS cybersecurity requirements, and CMMC. The role owns the cybersecurity strategy, governance, risk framework, security architecture, operations, incident response, resilience, data protection, third-party risk, and workforce security programs. It leads a high-performing security organization; manages budgets, workforce plans, technology portfolios, and third-party services; and establishes measurable outcomes for risk reduction and business value. The CISO oversees federal-contracting cybersecurity compliance, secure software development and cloud security governance, security operations, incident response, and enterprise resilience.

Requirements

Bachelor’s degree or equivalent experience in Cybersecurity, Computer Science, Information Systems, Engineering, Business Administration, Risk Management, or a related field.
At least 12 years of progressive experience in cybersecurity, technology risk, information technology, engineering, or related disciplines, including significant enterprise security leadership responsibility.
At least 5 years leading managers, multidisciplinary security teams, or enterprise-wide security programs in a complex, distributed organization.
Demonstrated experience advising executive leadership or a Board on material cyber risk, incidents, regulatory obligations, program maturity, and investment priorities.
Demonstrated ownership of security strategy, governance, architecture, operations, incident response, third-party risk, vulnerability management, identity, data protection, and security awareness capabilities.
Experience establishing or governing DevSecOps and secure SDLC practices across CI/CD pipelines, cloud platforms, application development, APIs, Infrastructure as Code, and software supply chains.
Experience with federal contracting cybersecurity requirements, including CUI and FCI handling, NIST SP 800-171 implementation or assessment, DFARS cybersecurity obligations, CMMC scoping and readiness, SSPs, POA&Ms, evidence management, and supplier flow-downs.
Experience managing budgets, vendors, managed services, workforce plans, and multi-year transformation roadmaps.
Working knowledge of modern enterprise architecture, cloud security, Zero Trust, identity and access management, data security, security operations, threat and vulnerability management, privacy-supporting controls, resilience, and secure software development.
Ability to interpret laws, regulations, standards, contractual clauses, and customer requirements and translate them into practical governance, control, evidence, and accountability models.
Ability to communicate technical and compliance issues in concise business language, including consequences, options, cost, and residual risk.
Ability to translate complex cyber risk into business decisions and build trust across technical, operational, legal, and executive audiences.
Ability to make defensible, evidence-based risk decisions using business context, threat intelligence, materiality, and documented risk ownership.
Ability to convert strategy into funded roadmaps, accountable outcomes, measurable controls, and sustainable operating processes.
Ability to partner with technology and business teams to implement secure solutions without unnecessary friction.
Ability to communicate clearly, remain decisive under pressure, and coordinate cross-functional response to high-impact events.
Financial and commercial acumen to connect cyber investments and contractual obligations to business value, loss avoidance, client trust, and growth.

Nice To Haves

Master’s degree or equivalent advanced study.
Experience in a highly regulated, project-based, engineering, professional services, critical infrastructure, or similarly complex environment.
One or more senior cybersecurity certifications such as CISSP, CISM, CCSP, CRISC, or equivalent.
Additional credentials in cloud security, risk, privacy, secure software development, federal compliance, or CMMC assessment.

Responsibilities

Own and maintain a multi-year enterprise cybersecurity strategy, operating model, roadmap, and investment plan aligned with business objectives, risk appetite, legal obligations, client commitments, and the threat landscape.
Lead cybersecurity governance and provide decision-ready reporting to executive leadership and the Board on risk posture, incidents, control effectiveness, program maturity, investment needs, and remediation progress.
Define security accountability, policies, standards, control objectives, exceptions, and risk-acceptance processes with documented business ownership.
Build, lead, develop, and retain a high-performing security organization; define roles, succession plans, performance measures, and sourcing models.
Manage cybersecurity operating and capital budgets, workforce plans, technology portfolios, and third-party services.
Own the enterprise cyber risk management framework and methods for identifying, assessing, prioritizing, treating, accepting, monitoring, and reporting security risk.
Provide executive oversight for federal cybersecurity compliance, including FCI and CUI scoping, shared responsibility, evidence retention, continuous monitoring, and assessment readiness.
Oversee implementation and sustainment of CMMC, NIST SP 800-171, DFARS cybersecurity clauses, FAR safeguarding requirements, SSPs, POA&Ms, assessment results, and contractual incident-reporting and information-protection obligations.
Partner with Legal, Contracts, Procurement, Compliance, and business leaders to review solicitations and contract language, establish security obligations, flow down requirements to subcontractors, and avoid unsupported compliance representations.
Coordinate internal assessments, independent reviews, customer inquiries, regulator interactions, and CMMC assessment preparation; ensure findings are prioritized, funded, tracked, and validated to closure.
Maintain alignment with applicable frameworks and obligations, including NIST CSF, NIST SP 800-53, ISO/IEC 27001, privacy requirements, breach-notification laws, and client requirements.
Establish security architecture principles and reference architectures for identity, endpoint, network, cloud, data, applications, APIs, operational technology, and third-party connectivity.
Sponsor DevSecOps and secure software development lifecycle practices across planning, architecture, coding, build, test, release, deployment, and operations.
Require risk-based security gates and automated controls in CI/CD pipelines, including code and dependency scanning, secrets detection, software composition analysis, infrastructure-as-code scanning, container and artifact assurance, and appropriate security testing.
Ensure engineering teams apply threat modeling, secure coding, code review, least privilege, environment segregation, change control, vulnerability remediation, logging, and security acceptance criteria.
Govern software supply-chain risk, open-source use, code provenance, artifact integrity, software bills of materials when required, third-party components, and secure release practices.
Partner with technology and engineering leaders to create reusable security patterns, paved roads, guardrails, and metrics that improve developer experience and reduce risk and delivery friction.
Provide security governance for cloud platforms, Infrastructure as Code, APIs, low-code/no-code platforms, citizen development, artificial intelligence, and machine learning use cases.
Oversee security monitoring, detection engineering, threat intelligence, vulnerability and exposure management, penetration testing, identity threat protection, endpoint and email security, data protection, and security operations center capabilities.
Maintain an enterprise cyber incident response program with severity criteria, decision rights, communications, legal and regulatory coordination, evidence preservation, customer-notification support, and executive escalation.
Lead or coordinate responses to material cyber incidents and ensure after-action reviews produce measurable corrective actions.
Partner with business continuity, disaster recovery, crisis management, and operational leaders to validate recovery strategies, ransomware resilience, backup protection, and exercises for high-impact scenarios.
Develop measurable key risk and performance indicators for control effectiveness, remediation velocity, resilience, and business impact.
Establish security requirements for data classification, handling, retention, encryption, loss prevention, access governance, records protection, and secure disposal with Legal, Privacy, and data owners.
Oversee cybersecurity due diligence and lifecycle risk management for suppliers, software providers, cloud services, managed service providers, subcontractors, and other third parties.
Incorporate security requirements into procurement, contracts, onboarding, monitoring, renewal, and termination processes, including applicable federal flow-down obligations.
Lead security awareness, role-based training, phishing resilience, executive education, and privileged-user training programs.
Coordinate insider-risk, personnel-security, physical-security, and workplace-safety interfaces with Human Resources, Legal, Facilities, and business leadership.
Advise executive leadership and the Board on cyber risk, incidents, regulatory obligations, program maturity, and investment priorities.
Manage vendors, managed services, workforce plans, and multi-year transformation roadmaps.