Director, Information Security

University of Maryland Global Campus • Adelphi, MD

1d

About The Position

The Director of Information Security develops, implements, and monitors a strategic, comprehensive enterprise cybersecurity and IT risk management program. The role provides the vision and leadership needed to manage organizational risk and ensure business alignment, effective governance, and the availability, integrity, and confidentiality of systems and products. The Director is an integral part of the Information Security team supporting the organization’s customers.

The Director assesses the organization’s security needs, priorities, and opportunities; creates and executes an information security program and roadmap that can scale with organizational growth; and leads global security assessments and testing, including penetration testing, vulnerability management, and secure software development. The role plans and manages incident response, develops security tooling and automation, identifies potential threats, leads compliance activities, and educates the organization about security threats and protections.

As a cross-functional leader, the Director provides direction to accountable stakeholders in a matrix environment, serves as the information security expert to the Executive team, advocates for secure application and infrastructure practices throughout the software development lifecycle, and manages relationships with external security vendors and professional services firms. The Director also attracts, develops, and retains a talented team as the information security program grows.

The position is located in Adelphi, Maryland. The hiring range is $195,000 to $205,000. Applicants must submit a cover letter and resume.

Requirements

• At least 8 years of relevant experience in information security.
• At least 4 years of progressively responsible management and/or leadership experience in information security or network administration, including 2 years of supervisory experience.
• Experience developing, maintaining, and implementing an information security program, including policy and strategy development.
• Experience addressing information security issues involving identity and access management, intrusion detection, forensics, incident management, risk management, and/or auditing.
• Experience evaluating and advising on information security software and hardware acquisitions, IT services, cloud-based solutions, and mobility.
• Knowledge of security assessment and testing tools.
• Experience developing and managing an information security awareness and training program.
• Experience with information security and compliance matters, such as FERPA, HIPAA, PCI-DSS, GLBA, copyright, and software piracy.
• Experience managing and negotiating vendor contracts and agreements.
• Ability to communicate effectively through writing and oral presentations, including across all organizational levels.
• Strong business acumen and ability to collaborate, influence, educate, build relationships, and encourage adoption of sound security practices.
• Expert experience with cloud security platforms and services, including current offerings from providers such as AWS and Azure and their application to securing a SaaS enterprise environment.
• Experience evaluating and implementing enterprise-wide security technologies and concepts, including SIEM, application security, cloud security, data loss prevention, security event management, threat and vulnerability management, and identity and access management.
• Clear understanding of relevant information security governance, technical and security standards, and regulations.
• Familiarity with OWASP, FedRAMP, AICPA SOC, NIST 800-53 and 800-171, ISO 27001, CMMC, ISO 27018, GDPR, and regional data privacy standards.
• Deep knowledge of networking and network security.
• Strong understanding of and experience with secure SDLC, DevSecOps, or security automation.
• Ability to work under pressure across multiple stakeholders.
• Professional information security certification or equivalent; examples include CISSP, CISM/A, CompTIA Security+, Certified Ethical Hacker, CCSP, or GCIA.

Nice To Haves

• Experience at an institution of higher education.
• Bachelor’s degree.

Responsibilities

• Assess the organization’s security needs, priorities, and opportunities and develop and execute an information security program.
• Design and develop an information security roadmap that aligns with and scales alongside organizational growth.
• Lead global security assessment and testing processes, including penetration testing, vulnerability management, and secure software development.
• Plan and manage incident response while minimizing business impact.
• Develop and extend security tooling and automation across the organization.
• Proactively identify security issues and potential threats, and build processes and systems to monitor and protect against them.
• Lead compliance activities, including external audits, regulatory compliance projects, and information security reviews.
• Educate the organization about security threats and implement threat protection measures.
• Provide cross-functional leadership and direction to accountable stakeholders in a matrix environment with dotted-line reports.
• Serve as the information security expert to the Executive team.
• Advocate for secure application and infrastructure practices throughout the software development lifecycle.
• Manage relationships with external information security technology vendors and specialized information security professional services firms.
• Attract, develop, and retain a talented information security team.

Benefits

• 22 days of paid vacation, 15 days of sick leave, 3 personal days, and 16 paid holidays (17 during general election years); part-time rates are prorated.
• Health care coverage, including medical with vision, dental, and prescription plans for individuals and families, effective the first of the month following hire.
• Term life insurance, accidental death and dismemberment insurance, and long-term disability insurance; part-time employees working less than 0.5 FTE are not eligible for LTD.
• Flexible spending accounts for medical and dependent care expenses.
• Choice of the Optional Retirement Program (ORP) or Maryland State Retirement and Pension System (MSRPS).
• Supplemental retirement plans including 401(k), 403(b), 457(b), and Roth options; the university does not provide matching funds.
• Tuition remission is immediately available for regular exempt staff. Spouses and dependent children may receive undergraduate tuition remission after two years of service; eligible part-time employees receive prorated benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed