Division Head, Information Security

Associated Universities • Socorro, NM

8d

About The Position

The National Radio Astronomy Observatory (NRAO), managed and operated by Associated Universities, Inc. (AUI) under a cooperative agreement with the National Science Foundation, is seeking an experienced information security professional or CISO to lead its enterprise information security program. The Division Head (DH) provides strategic, operational, and technical leadership for cybersecurity across the Observatory’s scientific, operational, and enterprise technology environments, while supporting its scientific mission. The DH reports directly to the Deputy Chief Information Officer and serves as the Observatory’s senior leader for cybersecurity strategy, governance, risk management, and security operations.

The role will lead a significant transformation of the Observatory’s cybersecurity capabilities by addressing vulnerabilities and establishing sustainable security processes, technologies, governance structures, and operating disciplines. The DH must be able to engage technically with infrastructure engineers, network architects, system administrators, scientific computing specialists, and application development teams, while also building organizational accountability and guiding cultural and operational change.

The DH will collaborate with the Associate Director of Data Management and Software, Deputy CIO, technology architects, infrastructure engineering, Science IT, and other stakeholders to define security requirements and coordinate implementation. The position defines cybersecurity policies, standards, controls, and risk management processes; partners with technology owners to implement and maintain controls; and provides leadership with regular assessments, material risk reports, remediation updates, and investment recommendations. The role is based in Albuquerque, NM; Socorro, NM; Charlottesville, VA; or Green Bank, WV. A remote work arrangement may be considered for well-qualified candidates. Occasional domestic and international travel may be required.

Requirements

• Bachelor’s degree in Cybersecurity, Information Assurance, Computer Science, Engineering, or a related discipline; highly relevant experience may be considered in lieu of a bachelor’s degree.
• Minimum seven years of extensive technical knowledge and experience directing staff in support of scientific or technical research.
• Comprehensive understanding of the NIST Cybersecurity Framework and other recognized cybersecurity standards and control frameworks.
• Experience establishing enterprise security policies, control standards, risk assessment processes, and compliance programs.
• Experience conducting cybersecurity maturity assessments and translating findings into prioritized remediation initiatives.
• Demonstrated ability to develop risk-based security investment strategies and measurable program improvement objectives.
• Experience establishing or leading security operations and incident response capabilities.
• Experience developing incident response procedures, operational playbooks, and security monitoring standards.
• Demonstrated ability to coordinate technical remediation across multiple engineering and operations teams.
• Demonstrated ability to lead significant cybersecurity improvement initiatives in organizations with immature or inconsistently implemented security controls.
• Strong organizational change management, stakeholder engagement, and cross-functional leadership skills.
• Ability to establish governance and accountability while maintaining productive working relationships with scientific and technical communities.
• Experience managing budgets, vendor relationships, technology investments, and multidisciplinary security teams.
• Must be authorized to work in the United States; AUI cannot currently sponsor H-1B visas for this position.
• Must be able to operate a personal computer.

Nice To Haves

• Professional certifications such as CISSP, CISM, CISA, CRISC, or equivalent advanced cybersecurity credentials.
• Experience serving as a CISO, Deputy CISO, Director of Information Security, or equivalent cybersecurity executive.
• Experience developing or transforming cybersecurity programs within research institutions, national laboratories, universities, federally funded research organizations, or other scientific computing environments.
• Familiarity with cybersecurity challenges associated with high-performance computing, scientific instrumentation, research networks, and large-scale data processing.
• Experience securing Linux-intensive infrastructure environments and open-source technology ecosystems.
• Familiarity with research and education identity federation, distributed authentication, and scientific collaboration platforms.
• Familiarity with federal cybersecurity requirements, contractual security obligations, and security expectations applicable to federally funded research organizations.
• Experience developing cybersecurity metrics, executive scorecards, and security maturity reporting frameworks.

Responsibilities

• Lead transformation of the Observatory’s cybersecurity posture by identifying and addressing systemic weaknesses, architectural vulnerabilities, immature operational processes, and gaps in security technologies and controls.
• Develop, implement, and maintain an enterprise information security strategy aligned with the Observatory’s scientific mission, priorities, and technology modernization initiatives.
• Establish an enterprise cybersecurity operating model that defines security functions, processes, responsibilities, accountability, service expectations, and collaboration with other technology organizations.
• Balance effective cybersecurity controls with scientific openness, high-performance computing, external collaboration, and operational flexibility.
• Develop, maintain, and enforce cybersecurity policies, standards, procedures, and technical control requirements across the Observatory.
• Develop governance mechanisms to review security implications of technology acquisitions, infrastructure modernization, software development, and scientific computing initiatives.
• Integrate cybersecurity requirements into technology architecture standards, operational procedures, procurement activities, and project delivery.
• Collaborate with organizational and technical stakeholders to establish security requirements and coordinate implementation.
• Partner with technology owners to implement and maintain security controls.
• Provide cybersecurity posture assessments, material risk reports, remediation progress updates, and investment recommendations to the Deputy CIO and other designated leadership.
• Establish or lead security operations and incident response capabilities, including procedures, operational playbooks, and security monitoring standards.
• Coordinate technical remediation activities across engineering and operations teams.
• Manage budgets, vendor relationships, technology investments, and multidisciplinary security teams.

Benefits

• Excellent paid time off, including 13 holidays and annual accrual of up to 24 vacation days.
• Medical, dental, and vision plans effective on the first day of employment, subject to eligibility requirements.
• Retirement benefit equal to 10 percent of a qualified participant’s base pay, with no required employee contribution.

What This Job Offers

• Job Type: Full-time
• Career Level: Director