Chief Information Security Officer

County of Lancaster•Lancaster, PA

2d•Onsite

About The Position

The Chief Information Security Officer (CISO) provides strategic leadership and oversight of the County’s enterprise cybersecurity, information security, risk management, and cyber resilience programs. Working closely with the CIO and Deputy CIO, the CISO is responsible for protecting County information, technology systems, networks, applications, cloud services, and other digital assets from cybersecurity threats and ensuring appropriate safeguards are established across County operations. The CISO develops and maintains Countywide cybersecurity policies, standards, and security architecture; assesses and manages cybersecurity risk; oversees vulnerability management and security monitoring; directs cybersecurity incident response; evaluates third-party and emerging technology risks; and advises County leadership regarding cybersecurity threats, risks, regulatory requirements, and recommended mitigation strategies. The position provides leadership and oversight for compliance with applicable cybersecurity, privacy, and information-protection requirements, including CJIS, HIPAA, and other federal, state, and local requirements. The CISO also develops and oversees the Countywide security awareness and training program and coordinates cybersecurity activities with County departments, technology providers, government partners, law enforcement, and other external organizations. The CISO provides cybersecurity oversight for the County’s business continuity and disaster recovery programs and coordinates with County departments to promote organizational resilience and continuity of critical technology services. This position is designated essential and may be required to respond to cybersecurity incidents, technology outages, natural disasters, or other emergencies outside normal business hours and when County offices are closed.

Requirements

Completion of a Bachelor’s Degree in Computer Science, or related field, and a minimum of seven (7) years experience in the Information Technology field or; Associate’s Degree in Computer Science, or related field, and a minimum of nine (9) years experience in Information Technology field or; Any equivalent combination of relevant education, experience, and training is acceptable.
At least one (1) year of management/leadership experience that included strategic planning, resource allocation, production methods, and coordination of people and resources, or; Any equivalent combination of education and experience.
Comprehensive knowledge of information security principles, frameworks, controls, and risk management practices, including the NIST Cybersecurity Framework (CSF) and other recognized government and industry cybersecurity standards.
Knowledge of applicable cybersecurity, privacy, and regulatory requirements and standards, including NIST guidance, CJIS Security Policy, HIPAA, and other federal, state, and local government requirements.
Knowledge of security architecture, identity and access management, network security, endpoint security, vulnerability management, incident response, and data protection.
Knowledge of business continuity, disaster recovery, and cyber incident preparedness and response.
Knowledge of current and emerging technologies, cybersecurity threats, vulnerabilities, and attack techniques.
Strong analytical, risk-assessment, problem-solving, and decision-making skills.
Ability to develop and maintain information security policies, standards, procedures, and security awareness programs.
Ability to appropriately manage highly confidential, sensitive, and security-related information.
Ability to communicate complex cybersecurity risks and recommendations effectively to technical staff, executive leadership, elected officials, department leadership, and other non-technical stakeholders.
Ability to lead, mentor, and provide technical and strategic direction to staff.
Ability to coordinate cybersecurity activities across County departments and with vendors, contractors, law enforcement, and external partners.
Ability to independently prioritize competing security risks and operational requirements while supporting County business needs.
Strong written and verbal communication, organizational, leadership, and interpersonal skills.
Valid driver's license and acceptable driving record in accordance with County policy
Acceptable pre-employment criminal background check.

Nice To Haves

CISM (or equivalent – Preferred after 1 year of employment)

Responsibilities

Develop, implement, maintain, and enforce Countywide cybersecurity and information security policies, standards, procedures, and technical security requirements consistent with the strategic direction established by the CIO.
Lead the County’s cybersecurity and information security program, including security governance, risk management, security architecture, vulnerability management, threat detection, incident response, identity and access security, data protection, and security awareness.
Identify, assess, prioritize, and communicate cybersecurity risks and vulnerabilities and coordinate appropriate mitigation, remediation, or risk acceptance with IT leadership, County departments, and other stakeholders.
Direct and coordinate the County’s response to cybersecurity incidents, including investigation, containment, recovery, documentation, notification, and coordination with executive leadership, law enforcement, government partners, insurers, and other external organizations as appropriate.
Provide leadership and oversight for compliance with applicable cybersecurity, privacy, and information-protection requirements, including CJIS, HIPAA, and other federal, state, and local requirements.
Develop, implement, and maintain a Countywide cybersecurity, privacy, and HIPAA security awareness and training program, including phishing preparedness and role-based security education.
Establish security requirements and provide cybersecurity review and guidance for new systems, applications, cloud services, infrastructure, integrations, and emerging technologies, including artificial intelligence.
Oversee third-party cybersecurity risk, including security assessments of vendors, contractors, hosted services, and technology providers and the development and review of appropriate contractual security requirements.
Develop and maintain cybersecurity incident response plans and provide security oversight and coordination for IT disaster recovery, business continuity, and cyber-resilience planning.
Monitor the County's cybersecurity posture through security monitoring, vulnerability assessments, audits, penetration testing, threat intelligence, and other appropriate security assessments.
Establish cybersecurity metrics and reporting and regularly advise the CIO, Deputy CIO, and other County leadership regarding cybersecurity posture, significant risks, threats, incidents, compliance, and remediation efforts.
Coordinate cybersecurity initiatives and information sharing with federal, state, and local government partners and other appropriate cybersecurity and law-enforcement organizations.
Evaluate emerging cybersecurity threats, technologies, industry practices, and regulatory changes and recommend appropriate changes to County security strategy, architecture, policies, and controls.
Provide leadership, direction, mentoring, and technical guidance to cybersecurity personnel and other IT staff and promote security awareness and accountability throughout the organization.
Develop and administer cybersecurity-related budgets, contracts, services, and technology investments consistent with organizational priorities and available resources.
Manage and direct cybersecurity contractors, consultants, service providers, and vendors and monitor their performance and compliance with County requirements.
Participate in strategic planning and collaborate with IT leadership to ensure cybersecurity requirements are appropriately incorporated into County technology strategy, projects, and operations.
Perform other duties as assigned and provide leadership during cybersecurity incidents, technology emergencies, and other events requiring an IT security response.
Perform other duties, tasks and special projects as required.