Strategic Advisor to the Chief Information Security Officer (CISO)

Job Description

Strategic Advisor to the Chief Information Security Officer (CISO)

Responsibilities

Strategic Advisory

Advise the CISO on cybersecurity strategy, program priorities, and the multi-year cybersecurity roadmap.

Provide analysis and recommendations on cybersecurity risks, emerging threats, and mitigation strategies.

Prepare briefings, decision memos, and presentations for the CISO and executive leadership.

Track progress on the CISO's strategic priorities and identify issues requiring attention or escalation.

Represent the CISO in meetings, working groups, audits, and engagements with regulatory agencies and external partners, as designated.

Promote collaboration between cybersecurity, Information Technology, and business units to integrate security throughout the technology lifecycle.

Cybersecurity Response Support

Advise the CISO on the effectiveness of the agency's cybersecurity response capabilities, including:

Cybersecurity incident response and recovery.

Security monitoring, threat detection, and analysis.

Vulnerability management and remediation.

Cyber incident preparedness, tabletop exercises, and operational readiness.

Security automation and continuous operational improvement.

Support the CISO during major incidents by coordinating information, tracking actions, and preparing executive communications.

Cybersecurity Risk Support

Provide expert guidance to the CISO and the Cybersecurity Risk Team on:

Enterprise cybersecurity risk assessments.

Security reviews of applications, cloud services, infrastructure, and emerging technologies.

Third-party and vendor security risk.

Risk exception decisions and security architecture considerations.

Enterprise cyber risk reporting and recommendations.

Cybersecurity Governance Support

Advise the CISO on the agency's cybersecurity governance framework to support effective risk management, regulatory compliance, and strategic decision-making, including:

Development and review of cybersecurity policies, standards, and procedures.

Regulatory and compliance activities, including HIPAA, PCI DSS, NIST, and other applicable requirements.

Internal and external audits and related corrective action plans.

The agency's cybersecurity Risk Register and Plans of Action & Milestones (POA&M).

Executive dashboards, cybersecurity metrics, and program performance reporting.

Evaluating the effectiveness of the cybersecurity program and recommending continuous improvements.

Special Projects and Initiatives

Lead high-priority, cross-functional cybersecurity initiatives and special projects as assigned by the CISO.

Provide program management and coordination for strategic cybersecurity efforts.

Research and evaluate emerging technologies, threats, and industry best practices, and recommend actions.

Support budget planning, contract review, and vendor evaluations as requested by the CISO.

Strategic Responsibilities

Contribute to the development and implementation of multi-year cybersecurity strategies and roadmaps.

Support efforts to advance the maturity of the agency's cybersecurity governance program.

Help strengthen enterprise cyber resilience and incident readiness.

Promote security-by-design principles across technology initiatives.

Help measure and communicate cybersecurity program performance using meaningful operational and risk metrics.

Support organizational objectives by balancing security, operational efficiency, compliance, and business enablement.

Skills Reqd

Bachelor's degree from an accredited college or university in Information Security, Computer Science, Information Technology, Business Administration, Public Administration, or a related field.

Ten (10) years of progressively responsible experience in information technology or cybersecurity, including experience in cybersecurity operations, risk management, governance, incident response, and security program management.

Five (5) years of experience in senior advisory, leadership, or program management role supporting cybersecurity or information technology programs.

Master's degree in Cybersecurity, Information Technology, Business Administration, Public Administration, or a related field.

Professional certifications such as CISSP, CISM, CRISC, CGEIT, or GIAC certifications.

Experience within government, healthcare, or other highly regulated environments.

Demonstrated experience implementing and managing cybersecurity frameworks such as the NIST Cybersecurity Framework, NIST SP 800-53, HIPAA Security Rule, PCI DSS, and CIS Critical Security Controls.

Strategic thinking and sound judgment as a trusted executive advisor.

Strategic planning and cybersecurity program development.

Enterprise cybersecurity governance and risk management.