Overview: (isc)² ® is the world`s largest nonprofit membership association of certified cybersecurity professionalsWe`re committed to helping our members learn, grow and thrive by providing world-class cybersecurity qualifications, professional development and engagement opportunities that inspire a safe and secure cyber worldWith more than 160,000 certified members, we empower professionals who touch every aspect of information securityPosition summary: this is no ordinary chief information security officer (ciso) roleAs the world’s largest association of certified cybersecurity professionals and the creator of the renowned cissp, (isc)2’s central role in the industry demands an exceptional and accomplished cybersecurity leaderThe (isc)2 ciso will lead our cybersecurity operations and serve as an inspirational advocate for security best practices around the worldThe ciso will be responsible for developing all appropriate security controls and risk management strategies for the organization; providing regular risk assessments and strategic developments to senior management and the board of directors; partnering with stakeholders throughout the association to ensure security is strategically ingrained within our operations; and publicly representing the association and advocating for our members through speaking engagements, webinars, media interviews and moreWe are an association of cybersecurity professionalsOur board is comprised of cybersecurity professionalsWe are looking for a visionary ciso who can satisfy all of our demanding stakeholders and produce the world-class cybersecurity program we need as we continue to invest in our membership, expand globally and pursue our goal of inspiring a safe and secure cyberworldResponsibilities:
Provide leadership and strategic direction
Execute a strategic, comprehensive it risk management program targeting information security and privacy mattersEnsure the integrity, confidentiality and availability of information owned, controlled, or processed by the organization.
Develop an it security architecture roadmap that will identify security controls as well as identify and assess technologies that will enforce the organization’s security priorities.
Create and manage a unified and flexible control framework to integrate and normalize the wide variety and ever-changing requirements resulting from global laws, standards and regulations.
Create a framework for roles and responsibilities with regard to information ownership, classification, accountability and protectionGuide and counsel organizational leaders on information security and its role in enabling mission activities and managing it security risk.
Develop and manage departmental budgets
Provide regular reporting on the current status of the information security program to business leaders and the board of directors as part of a strategic enterprise risk management program.
Ensure that security programs are in compliance with relevant laws, regulations, and policies to minimize or eliminate risk and audit findings.
Engage with external communities and activities to maintain good perspective on information security practices at peer organizations and the threat environment; promote and increase organizational ability to address common problemsMonitor the external threat environment for emerging threats and advise relevant stakeholders on the appropriate courses of action.
Liaise with external agencies, such as law enforcement and other advisory bodies as necessary, to ensure that the organization maintains a strong security posture.
Drive enterprise it security governance efforts in collaboration with other teams
Oversee the approval, training and dissemination of security policies and practices, as well as compliance from all employees, contractors, and approved system users.
Provide strategic risk guidance for it projects, including the evaluation and recommendation of technical controls.
Define and facilitate the information security risk assessment process, including the reporting and oversight of treatment efforts to address negative findings.
Understand and interact with related disciplines to ensure the consistent application of policies and standards across all technology projects, systems, and services, including, but not limited to, privacy, risk management, compliance and business continuity management.
Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the security.
Work closely with legal/compliance team to ensure that all practices and policies related to it security are free from bias and discrimination, appropriate understanding of regulatory requirements, and appropriate risk mitigation strategies.
Develop and manage a diverse, high performing team
Champion and advocate the value of diversity, equity, and inclusion at (isc)2 by taking action to increase workplace diversity by promoting and developing staff from under-represented groups.
Motivate and lead a diverse, high-performing team, utilizing effect talent management practices to attract and retain team membersEnsure high levels of employee engagement, operations performance excellence, commitment to continuous learning and appropriate succession planning.
Leadership and culture at (isc)²
Serve as the highest-level it security leader at (isc)².
Ensure that all regulatory and auditing guidelines are followed, and solid business practices are implemented.
Maintain strong working relationships with organization leadership and teams to align information security practices across the organization.
Partner with organization leaders and be a resource to others to offer solutions that proactively minimize security risk, liability or concerns utilizing a broad and inclusive view to help the organizational activities be successful.
Ability to build an inclusive culture that encourages, supports and celebrates diversity; serve as a role model to promote dei best practices.
Foster a culture of innovation, transparency and accountability; inspire cooperation among teams and co-workers.
Serve as a member of the executive leadership team, champion (isc)2’s employee culture, and consistently lead by example.
Advocacy and thought leadership
Represent (isc)2 and promote security best practices globally via digital and in-person channels
Support (isc)2 thought leadership initiatives from strategy development to public dissemination of messages via media, conferences, webinars and more
Qualifications:
Bachelor’s degree in a technical concentration (e.g., computer science) is requiredAn information technology master’s degree is strongly preferred.
A cissp is required for this position; additional cybersecurity certifications, particularly those offered by (isc)² are desirable.
At least 15 years of professional experience leading, designing, and implementing an enterprise information security strategy and program.
Proven skills in leadership of a significant it organization, with a track record in delivering committed results in a complex and diverse environment.
Ability to immediately establish credibility within the organization, as well as with customers and partnersMust have the managerial skills to work effectively across all functions and levels of the organization.
A natural leader with a tenacious drive for results who is able to hold the organization and individuals, including self, accountable.
Demonstrated project management skill; success in it planning, organization and development; expert knowledge of current and developing technologies.
Demonstrated leadership and expertise working with media and in live and virtual presentations
Skills/competencies
Ability to demonstrate and support the 5 company core values integrity, excellence, unity, accountability, agility
Excellent verbal and written communication and interpersonal skills
Demonstrated skills in complex decision-making, problem-solving and planning
Strong analytical thinking and innovation skills
Strong systems thinking and relationship management skills, including ability to influence stakeholders
Strong customer service orientation and awareness to drive key critical decisions and resolve complex problems
Physical & mental
Ability to travel up to 30% of the time, may also include overnight and international travel
In-person meetings will be required
Work normal business hours and extended hours when necessary, to be flexible with various time zones
Remain in a stationary position, often standing or sitting, for prolonged periods
Regular use of office equipment such as a computer/laptop and monitor computer screens
Dexterity of hands and fingers to operate a computer keyboard, mouse, and other computer components
