Information Security Officer

Commonwealth of Massachusetts•Boston, MA

About The Position

The Massachusetts Department of Mental Health (DMH) is seeking an Information Security Officer (ISO) to lead and coordinate its agency-wide information security program. The ISO is the senior agency-level official accountable for ensuring that cybersecurity risks affecting DMH information, applications, technology-enabled services, and electronic protected health information (ePHI) are identified, assessed, communicated, and treated consistently with DMH mission needs, legal and regulatory obligations, Commonwealth requirements, and accepted risk-management practices. The role provides independent security governance and risk oversight, working closely with DMH business and application owners, the Privacy and Data Access Officer, Compliance, General Counsel, Quality, facility leadership, EOHHS IT and Secretariat technology leadership, and EOTSS Cybersecurity and Enterprise Risk Management/Security Operations. The ISO is accountable for the effectiveness of the agency security management program, but is not expected to personally operate every technical security control provided by partner teams, vendors, or managed service providers. The position supports DMH’s mission to assure and provide access to services and support that meet the mental health needs of individuals of all ages, promote recovery and culturally competent care, protect human rights, and support mental health training and research. The position is subject to a requirement to acknowledge and attest to COVID-19 and influenza vaccination status, or applicable mitigation measures, under Title 101 CMR 23.00.

Requirements

At least six years of full-time or equivalent part-time professional, administrative, supervisory, or managerial experience in business administration, business management, public administration, public management, clinical administration, or clinical management.
At least two years of the required experience must have been in a project management, supervisory, or managerial capacity.
Equivalent combinations of experience and the listed education or certificate substitutions may be considered.
A relevant or related certificate may substitute for one year of the required experience.
A bachelor's degree in a related field may substitute for two years of the required experience.
A graduate degree in a related field may substitute for three years of the required experience.
A doctorate in a related field may substitute for four years of the required experience.

Nice To Haves

Extensive knowledge of information security governance, cybersecurity risk management, and enterprise security frameworks, including policy development, risk assessments, internal-control evaluation, and remediation.
Knowledge of healthcare information security regulations, including the HIPAA Security Rule and requirements for protecting ePHI and other confidential data.
Understanding of cybersecurity frameworks and best practices, including the NIST Cybersecurity Framework, NIST risk management principles, CIS Controls, and secure system development practices.
Experience implementing and evaluating identity and access management controls, including role-based access, multi-factor authentication, privileged access management, user authorization, and periodic access reviews.
Knowledge of cybersecurity technologies and security operations, including cloud security, network protection, encryption, vulnerability management, security monitoring, incident response, and threat mitigation.
Experience assessing risks related to enterprise applications, cloud platforms, third-party vendors, and data-sharing environments, and recommending practical solutions aligned with operational objectives.
Experience supporting business continuity, disaster recovery, and cybersecurity incident response planning.
Familiarity with Commonwealth of Massachusetts information security policies, standards, and procedures, including those established by EOTSS, or ability to acquire this knowledge quickly.
Strong analytical, written, verbal communication, and interpersonal skills, including ability to explain cybersecurity risks and advise executive leadership and technical and nontechnical stakeholders.
Leadership, strategic planning, and organizational management abilities, including managing competing priorities, setting security performance measures, influencing cross-functional teams, and exercising independent judgment in a complex healthcare, government, or similarly regulated environment.

Responsibilities

Lead and oversee DMH’s agency-wide information security program, including development of cybersecurity strategies, policies, procedures, and governance frameworks.
Direct enterprise cybersecurity risk management by identifying, assessing, prioritizing, and communicating vulnerabilities, compliance gaps, and emerging threats; recommend mitigations and monitor corrective actions.
Provide strategic oversight of application, system, and data security to protect the confidentiality, integrity, and availability of sensitive information, including ePHI, across technology platforms, cloud services, and data-sharing environments.
Oversee identity and access management practices, including authentication protocols, access controls, privileged account management, and periodic security reviews.
Coordinate cybersecurity incident response and vulnerability management with internal stakeholders, Commonwealth technology partners, and external service providers.
Advance business continuity, disaster recovery, and organizational resilience initiatives by evaluating critical technology dependencies, strengthening recovery strategies, and supporting preparedness efforts.
Oversee third-party cybersecurity risk and regulatory compliance, including evaluation of vendor security practices, establishment of security requirements, and support for audits, assessments, and accreditation activities.
Collaborate with executive leadership, legal counsel, privacy officers, technology teams, and operational stakeholders to integrate cybersecurity into decision-making, modernization, procurement, and strategic initiatives.
Promote cybersecurity awareness and accountability through expert guidance, security education, and communication of risks, expectations, and best practices.
Advise senior leadership by delivering executive-level risk assessments, security performance reports, and strategic recommendations, and exercise independent judgment to strengthen security governance and regulatory readiness.