Enterprise Chief Information Security Officer

RSM US LLP•Boston, MA

About The Position

We are the leading provider of professional services to the middle market globally, our purpose is to instill confidence in a world of change, empowering our clients and people to realize their full potential. Our exceptional people are the key to our unrivaled, culture and talent experience and our ability to be compelling to our clients. You’ll find an environment that inspires and empowers you to thrive both personally and professionally. There’s no one like you and that’s why there’s nowhere like RSM. The Chief Information Security Officer (CISO) is responsible for the mission, vision, strategy, and execution of the organization’s global cybersecurity program. The CISO serves as the senior global cybersecurity leader, accountable for setting enterprise priorities, advising executive and board stakeholders on material cyber risk, and ensuring cybersecurity risk management supports business outcomes across regions, markets, and functions. This role leads through influence across cultures, jurisdictions, and business environments; establishes consistent global operating expectations; and guides coordinated strategy, execution, and response across distributed teams. The CISO partners with technology, operations, legal, compliance, and business leaders to protect information assets, maintain regulatory alignment, support client and business requirements, and strengthen the organization’s global security posture.

Requirements

Bachelor’s degree or equivalent combination of education and experience
Ability to lead effectively through ambiguity and provide structure in complex, evolving situations
Strong critical thinking, analytical, and problem-solving skills, including the ability to analyze security requirements and align them to appropriate security controls
10 years’ experience in a technology security role
7 years’ experience working with legal, audit, compliance, and regulatory stakeholders in a global or multi-jurisdictional environment
Subject matter expert in applicable industry regulations, standards, and frameworks such as GLBA, GDPR, CCPA, ISO 27001, CMMC
Ability to articulate business imperatives and the business impact of security tools, technologies, policies, and controls
Excellent verbal, written, and interpersonal communication skills across all levels of the organization
Ability to influence and advise technology, business, executive, and board stakeholders on cybersecurity strategy, risk, and business impact
Demonstrated ability to lead, coach, and align distributed global teams; influence senior stakeholders across regions, cultures, and time zones; and drive enterprise-wide outcomes without relying solely on direct authority
Experience setting and executing global cybersecurity strategy, operating expectations, governance forums, leadership routines, decision-making frameworks, and response plans across complex, matrixed, and highly regulated environments
Experience leading enterprise cybersecurity strategy, governance, incident response, threat and vulnerability management, and data protection programs

Nice To Haves

CISSP, CISM, or similar information security certification preferred
Master’s or doctorate degree
Experience developing cybersecurity talent, succession, and workforce capability strategies across distributed or global teams
Experience supporting the secure adoption of emerging technologies and evolving cryptographic requirements

Responsibilities

Set, communicate, and champion the global cybersecurity vision, strategy, and priorities, ensuring consistent direction and execution across regions while accounting for local regulatory, client, and business requirements.
Advise executive leadership and board stakeholders on material cybersecurity risks, program effectiveness, risk-based investment decisions, and the business impact of security strategies, policies, and controls.
Lead global cybersecurity crisis response for material incidents, regulatory inquiries, client requirements, and emerging risks, serving as the senior decision-maker for escalation, cross-border coordination, stakeholder alignment, and timely executive communications.
Establish and maintain cybersecurity governance for information ownership, classification, protection, and risk-informed decision-making.
Guide the secure adoption of emerging technologies and prepare the organization for evolving cybersecurity risks and cryptographic requirements.
Oversee governance, risk, and compliance activities, including applicable certifications, regulatory requirements, industry standards, and significant third-party and internal cybersecurity audits.
Lead the continued maturity and resiliency of the cybersecurity function through an agile program that supports business objectives.
Build, lead, coach, and enable high-performing global cybersecurity teams by establishing clear operating models, decision rights, escalation paths, leadership routines, and accountability across distributed functions, regions, and time zones.
Develop global cybersecurity leadership capability through consistent standards, knowledge sharing, inclusive leadership practices, and succession readiness.
Manage the cybersecurity budget, establish priorities, and secure support for key initiatives.
Establish metrics, reporting, and governance forums that communicate global cybersecurity program effectiveness, enterprise risk posture, regional considerations, and business value to executive and board stakeholders.
Build alignment with technology and business leaders to incorporate cybersecurity requirements into organizational architecture and decision-making.
Maintain external relationships with global peers, partners, vendors, regulators, and industry groups to address shared cybersecurity risks, emerging trends, and cross-border requirements.
Support other strategic cybersecurity, risk, and leadership priorities as needed.