Director, Information Security

University of Maryland Global Campus • Adelphi, MD

2d • $195,000 - $205,000

About The Position

The Director of Information Security develops, implements, and monitors a strategic, comprehensive enterprise cybersecurity and IT risk management program. The role provides the vision and leadership needed to manage organizational risk while ensuring business alignment, effective governance, and the availability, integrity, and confidentiality of systems and products. The Director is an integral member of the Information Security team supporting UMGC customers.

The Director assesses the organization’s security needs and priorities, builds an information security program and roadmap that can scale with organizational growth, and leads security assessment, testing, incident response, tooling, automation, compliance, and threat protection efforts. The role advocates for secure application and infrastructure practices throughout the software development lifecycle, advises executive leadership, and works across a matrixed organization with accountable stakeholders. The Director also manages external vendor and professional-services relationships and builds and develops the information security team.

Requirements

• At least 8 years of relevant experience in information security.
• At least 4 years of progressively responsible management and/or leadership experience in information security or network administration, including 2 years of supervisory experience.
• Experience developing, maintaining, and implementing an Information Security Program, including policy and strategy development.
• Experience addressing information security issues involving identity and access management, intrusion detection, forensics, incident management, risk management, and/or auditing.
• Experience evaluating and advising on information security software and hardware acquisitions, IT services, cloud-based solutions, and mobility.
• Knowledge of security assessment and testing tools.
• Experience developing and managing an information security awareness and training program.
• Experience with information security and compliance issues, such as FERPA, HIPAA, PCI-DSS, GLBA, copyright, and software piracy.
• Experience managing and negotiating vendor contracts and agreements.
• Ability to communicate effectively in writing and oral presentations, including across all levels of an organization.
• Strong business acumen and ability to collaborate, influence, educate, build relationships, and foster adoption of sound security practices.
• Expert experience with cloud security platforms and services, including current offerings from leading cloud providers such as AWS and Azure and their application to securing a SaaS enterprise environment.
• Experience evaluating and implementing enterprise information security technologies and concepts, including SIEM, application security, cloud security, data loss prevention, security event management, threat and vulnerability management, and identity and access management.
• Understanding of information security governance, technical and security standards, and regulations, including OWASP, FedRAMP, AICPA SOC, NIST 800-53, NIST 800-171, ISO 27001, CMMC, ISO 27018, GDPR, and regional data privacy standards.
• Deep knowledge of networking and network security.
• Strong understanding and experience with Secure SDLC, DevSecOps, or security automation.
• Ability to work under pressure across multiple stakeholders.
• Professional information security certification or equivalent; examples include CISSP, CISM/A, CompTIA Security+, Certified Ethical Hacker, CCSP, or GCIA.

Nice To Haves

• Experience in higher education.
• Bachelor’s degree.

Responsibilities

• Assess the company’s security needs, priorities, and opportunities, and create and execute an information security program.
• Design and develop an information security roadmap aligned with company growth.
• Lead global security assessment and testing processes, including penetration testing, vulnerability management, and secure software development.
• Plan and manage incident response while minimizing business impact.
• Develop and expand security tooling and automation across the organization.
• Identify security issues and potential threats, and build processes and systems to monitor and protect against them.
• Lead compliance activities, including external audits, regulatory compliance projects, and information security reviews.
• Educate the organization about threats and implement threat-protection measures.
• Provide cross-functional leadership and direction to accountable stakeholders in a matrix environment, including dotted-line reports embedded in the business.
• Represent information security expertise to the Executive team.
• Advocate for secure application and infrastructure practices and ensure security is incorporated throughout the software development lifecycle.
• Manage relationships with external information security technology vendors and specialized professional services firms.
• Attract, develop, and retain a talented information security team as the program grows.

Benefits

• 22 days of paid vacation, 15 days of sick leave, 3 personal days, and 16 paid holidays (17 during general election years); part-time rates are prorated.
• Health care, medical with vision, dental, and prescription plans for individuals and families, effective the first of the month following hire.
• Term life insurance, accidental death and dismemberment insurance, and long-term disability insurance; part-time employees working less than 0.5 FTE are not eligible for LTD.
• Flexible spending accounts for medical and dependent care expenses.
• Choice of the Optional Retirement Program (ORP) or the Maryland State Retirement and Pension System (MSRPS).
• Supplemental retirement plans including 401(k), 403(b), 457(b), and Roth options; the university does not provide matching funds.
• Tuition remission for regular exempt staff, immediately available; spouses and dependent children become eligible for undergraduate tuition remission after two years of service. Eligible part-time employees receive prorated tuition remission.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed