Chief Information Security Officer

Texas Health & Human Services Commission•Austin, TX

9d•$11,298 - $19,108•Onsite

About The Position

The Texas Health and Human Services Commission (HHSC) is seeking a Chief Information Security Officer (CISO) to lead cybersecurity across a large, mission-critical public-sector technology environment. The CISO shapes cybersecurity across the HHS system, protecting critical services and sensitive information while enabling secure innovation and modernization. The role addresses emerging risks such as artificial intelligence, cloud transformation, third-party risk, and post-quantum cryptography. Reporting to the Deputy Chief Operations Officer, the CISO is the executive leader for Cybersecurity Operations and Information Security Governance, Risk, and Compliance. The CISO provides strategic oversight of cybersecurity operations, threat and vulnerability management, incident response and recovery, enterprise security governance, risk and compliance, security architecture, and modernization. Working with leaders in Procurement, Payroll, Human Resources, Facilities, and other operational functions, the CISO exercises significant latitude for independent judgment and decision-making. The CISO may represent HHS on cybersecurity matters with state and federal agencies, the Office of the Governor, the Texas Legislature, and other external stakeholders. The successful candidate translates cybersecurity risk into business decisions, builds partnerships across the organization, and leads a mature cybersecurity program protecting sensitive health, benefits, operational, and agency information.

Requirements

Graduation from an accredited four-year college or university with major coursework in cybersecurity, computer science, information technology, management information systems, engineering, public administration, business administration, or a related field; relevant senior-level experience may substitute for education.
At least 10 years of progressively responsible experience in cybersecurity, information security, technology risk management, security operations, enterprise technology leadership, or a closely related field.
Experience with cybersecurity frameworks, regulatory compliance, audit coordination, risk management, or security governance in a public-sector, healthcare, financial, critical infrastructure, or similarly regulated environment.
Knowledge of enterprise cybersecurity strategy, governance, risk management, security operations, incident response, and applicable regulatory requirements in a large public-sector environment.
Knowledge of state and federal cybersecurity frameworks and standards, including NIST guidance, Texas Administrative Code Chapter 202, the Texas Cybersecurity Framework, and risk-based security controls.
Knowledge of information security governance, security architecture, technology risk management, data protection, identity and access management, cloud security, and emerging cybersecurity trends.
Knowledge of business continuity, disaster recovery, vendor management, contract oversight, and third-party technology risk management.
Skill in leading large, complex cybersecurity programs and developing enterprise security strategies, governance structures, policies, and measurable outcomes.
Skill in translating cybersecurity risks into actionable business decisions and communicating effectively with executives, technical staff, public officials, auditors, and other stakeholders.
Skill in building collaborative relationships and leading security assessments, risk analyses, incident response efforts, audits, and remediation activities.
Skill in managing large-scale initiatives, budgets, contracts, competing priorities, and developing high-performing cybersecurity teams.
Ability to provide visionary leadership, exercise sound judgment, and foster a proactive, risk-informed, and mission-focused security culture.
Ability to balance security, compliance, operational needs, modernization efforts, and user experience while implementing effective solutions to complex challenges.
Ability to anticipate and address evolving cybersecurity threats and risks and maintain the security, availability, and integrity of critical systems and information resources.
Ability to exercise independent judgment, manage confidential information, and uphold high standards of ethics and professionalism.

Nice To Haves

Professional certification such as CISSP, CISM, CISA, CRISC, a GIAC certification, a cloud security certification, or comparable advanced cybersecurity credentials.
Experience leading cybersecurity, information security, technology risk, or technical teams in a large, complex organization.
Experience working in Health and Human Services agencies; Texas State Government experience is also preferred, followed by broader public-sector experience.

Responsibilities

Serve as the agency’s Designated Information Security Officer and align cybersecurity objectives with agency priorities, business operations, and risk management goals.
Lead development of long-term cybersecurity strategy, governance frameworks, and performance measures to support agency resilience and mission success.
Communicate cybersecurity risks, opportunities, posture, emerging threats, compliance obligations, and investment priorities to executive leadership in business terms.
Ensure information security risks are considered alongside operational, financial, regulatory, and strategic risks in enterprise decision-making.
Build trusted partnerships with agency leadership, programs, technology teams, and external stakeholders to understand business needs and deliver practical, risk-based cybersecurity solutions.
Promote a service-oriented security culture that enables agency operations and modernization while protecting critical information and systems.
Direct enterprise cybersecurity, risk management, and resilience activities to protect critical systems and ensure continuity of agency operations.
Provide strategic oversight of cybersecurity operations, incident response, disaster recovery, security architecture, compliance, and emerging technologies.
Integrate security into technology planning, procurement, operations, and third-party relationships.
Communicate cybersecurity priorities, status, risks, and emerging issues to executive leadership, staff, and key internal and external partners, and ensure timely escalation and coordination.
Direct the development, implementation, and oversight of policies, procedures, standards, and guidelines for CISO operations and HHS information security; monitor compliance.
Build and develop a high-performing cybersecurity workforce through coaching, training, professional development, and succession planning.
Lead or oversee security assessments, risk analyses, incident response efforts, audits, and remediation activities.
Manage large-scale initiatives, budgets, contracts, competing priorities, and cybersecurity teams.
Represent HHS on cybersecurity matters with state and federal agencies, the Office of the Governor, the Texas Legislature, and other external stakeholders as needed.