Chief Information Security Office

Kleinfelder•San Diego, CA

8d•$182,548 - $275,000

About The Position

The Chief Information Security Officer (CISO) is the enterprise executive accountable for the cybersecurity, information risk, privacy-supporting security, and cyber resilience program. The CISO establishes strategy, governance, architecture, and operating priorities to protect the organization, its clients, regulated data, intellectual property, and business operations while enabling growth, digital transformation, cloud adoption, artificial intelligence, and secure delivery of technology-enabled services. The role advises executive leadership and the Board on material cyber risk, regulatory and contractual obligations, threat conditions, investment priorities, and risk acceptance. It leads enterprise security, coordinates incident readiness and response, and partners with Information Technology, Legal, Privacy, Human Resources, Internal Audit, Procurement, Operations, and business leadership. The CISO also provides executive sponsorship for secure-by-design and DevSecOps practices and federal compliance programs, including CUI, FCI, NIST SP 800-171, DFARS cybersecurity requirements, and CMMC. The CISO owns enterprise cybersecurity strategy, governance, risk management, federal compliance oversight, security architecture, cloud and DevSecOps governance, security operations, incident response, resilience, data protection, third-party risk, and workforce security. The role leads a high-performing security organization; manages budgets, workforce plans, technology portfolios, and third-party services; and establishes measurable controls and outcomes aligned with business objectives, risk appetite, legal obligations, client commitments, and the threat landscape. The position requires a bachelor's degree or equivalent experience in a related field and at least 12 years of progressive relevant experience, including significant enterprise security leadership. A master's degree or equivalent advanced study is preferred. One or more senior cybersecurity certifications such as CISSP, CISM, CCSP, CRISC, or equivalent are strongly preferred. The expected salary range is $182,548–$275,000, with final compensation based on qualifications and experience. Applications are accepted through November 6, 2026. Following an offer, candidates must satisfactorily complete reference checks, verification of professional licensure and/or educational credentials, an MVR, and a comprehensive background check.

Requirements

Bachelor's degree or equivalent experience in Cybersecurity, Computer Science, Information Systems, Engineering, Business Administration, Risk Management, or a related field.
At least 12 years of progressive experience in cybersecurity, technology risk, information technology, engineering, or related disciplines, including significant enterprise security leadership responsibility.
At least 5 years leading managers, multidisciplinary security teams, or enterprise-wide security programs in a complex, distributed organization.
Demonstrated experience advising executive leadership or a Board on material cyber risk, incidents, regulatory obligations, program maturity, and investment priorities.
Demonstrated ownership of security strategy, governance, architecture, operations, incident response, third-party risk, vulnerability management, identity, data protection, and security awareness capabilities.
Experience establishing or governing DevSecOps and secure SDLC practices across CI/CD pipelines, cloud platforms, application development, APIs, Infrastructure as Code, and software supply chains.
Experience with federal contracting cybersecurity requirements, including CUI and FCI handling, NIST SP 800-171 implementation or assessment, DFARS cybersecurity obligations, CMMC scoping and readiness, SSPs, POA&Ms, evidence management, and supplier flow-downs.
Experience managing budgets, vendors, managed services, workforce plans, and multi-year transformation roadmaps.
Working knowledge of modern enterprise architecture, cloud security, Zero Trust, identity and access management, data security, security operations, threat and vulnerability management, privacy-supporting controls, resilience, and secure software development.
Ability to interpret laws, regulations, standards, contractual clauses, and customer requirements and translate them into practical governance, control, evidence, and accountability models.
Ability to communicate technical and compliance issues in concise business language, including consequences, options, cost, and residual risk.
Executive leadership and influence: ability to translate complex cyber risk into business decisions and earn trust across technical, operational, legal, and executive audiences.
Risk-based judgment: ability to make defensible decisions using evidence, business context, threat intelligence, materiality, and documented risk ownership.
Strategic execution: ability to convert strategy into funded roadmaps, accountable outcomes, measurable controls, and sustainable operating processes.
Collaboration and enablement: ability to partner with technology and business teams to implement secure solutions without unnecessary friction.
Crisis leadership: ability to communicate clearly, remain decisive under pressure, and coordinate cross-functional response to high-impact events.
Financial and commercial acumen: ability to connect cyber investments and contractual obligations to business value, loss avoidance, client trust, and growth.
Following an offer, satisfactorily complete employment reference checks, verification of professional licensure and/or educational credentials, a motor vehicle report, and a comprehensive background check.

Nice To Haves

Master's degree or equivalent advanced study.
Experience in a highly regulated, project-based, engineering, professional services, critical infrastructure, or similarly complex environment.
One or more senior cybersecurity certifications such as CISSP, CISM, CCSP, CRISC, or equivalent.
Additional credentials in cloud security, risk, privacy, secure software development, federal compliance, or CMMC assessment.

Responsibilities

Own and maintain a multi-year enterprise cybersecurity strategy, operating model, roadmap, and investment plan aligned with business objectives, risk appetite, legal obligations, client commitments, and the threat landscape.
Lead cybersecurity governance and provide executive leadership and the Board with decision-ready reporting on risk posture, incidents, control effectiveness, program maturity, investment needs, and remediation progress.
Establish security policies, standards, control objectives, exception and risk-acceptance processes, and clear accountability across the three lines model.
Build, lead, develop, and retain the security organization; define roles, succession plans, performance measures, and strategic sourcing models.
Manage cybersecurity operating and capital budgets, workforce plans, technology portfolios, and third-party services.
Own the enterprise cyber risk management framework and consistent processes for identifying, assessing, prioritizing, treating, accepting, monitoring, and reporting information security risk.
Provide executive oversight for federal cybersecurity compliance, including FCI and CUI scoping, shared-responsibility models, evidence retention, continuous monitoring, and assessment readiness.
Oversee implementation and sustainment of applicable CMMC, NIST SP 800-171, DFARS, and FAR requirements; govern SSPs, POA&Ms, assessment results, and contractual incident-reporting and information-protection obligations.
Partner with Legal, Contracts, Procurement, Compliance, and business leaders to review solicitations and contract language, determine security obligations, flow requirements down to subcontractors, and prevent unsupported compliance representations.
Coordinate internal assessments, independent reviews, customer inquiries, regulator interactions, and CMMC assessment preparation; ensure findings are risk-ranked, assigned, funded, tracked, and validated to closure.
Maintain alignment with applicable frameworks and obligations, including the NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001, privacy requirements, state breach-notification laws, and client-specific requirements.
Establish enterprise security architecture principles and reference architectures for identity, endpoint, network, cloud, data, application, API, operational technology, and third-party connectivity.
Sponsor DevSecOps and secure software development lifecycle practices across planning, architecture, coding, build, test, release, deployment, and operations.
Require risk-based security gates and automated CI/CD controls, including source-code and dependency scanning, secrets detection, software composition analysis, infrastructure-as-code scanning, container and artifact assurance, and appropriate security testing.
Ensure engineering teams apply threat modeling, secure coding standards, code review, least privilege, environment segregation, change control, vulnerability remediation, logging, and security acceptance criteria.
Govern software supply-chain risk, open-source use, code provenance, artifact integrity, software bills of materials when required, third-party components, and secure release practices.
Partner with technology and engineering leaders to create reusable security patterns, paved roads, guardrails, and metrics that improve developer experience while reducing risk and delivery friction.
Provide security governance for cloud platforms, Infrastructure as Code, APIs, low-code/no-code platforms, citizen development, artificial intelligence, and machine learning use cases.
Oversee security monitoring, detection engineering, threat intelligence, vulnerability and exposure management, penetration testing, identity threat protection, endpoint security, email security, data protection, and security operations center capabilities.
Maintain the enterprise cyber incident response program, including severity criteria, decision rights, communications, legal and regulatory coordination, evidence preservation, customer notification support, and executive escalation.
Lead or coordinate responses to material cyber incidents and ensure after-action reviews produce measurable corrective actions.
Partner with business continuity, disaster recovery, crisis management, and operational leaders to validate recovery strategies, ransomware resilience, backup protection, and exercises for high-impact scenarios.
Develop measurable key risk and performance indicators demonstrating control effectiveness, remediation velocity, resilience, and business impact.
Establish security requirements for data classification, handling, retention, encryption, loss prevention, access governance, records protection, and secure disposal with Legal, Privacy, and data owners.
Oversee cybersecurity due diligence and lifecycle risk management for suppliers, software providers, cloud services, managed service providers, subcontractors, and other third parties.
Ensure security requirements are included in procurement, contracts, onboarding, monitoring, renewal, and termination, including applicable federal flow-down obligations.
Lead security awareness, role-based training, phishing resilience, executive education, and privileged-user training; reinforce shared accountability for security.
Coordinate insider-risk, personnel-security, physical-security, and workplace-safety interfaces with Human Resources, Legal, Facilities, and business leadership.
Advise executive leadership and the Board on material cyber risks, incidents, obligations, program maturity, and investment priorities.