Chief Information Security Officer

Chief Information Security Officer

The mission of the Georgia Student Finance Commission is to promote and increase access to education beyond high school for Georgians. To achieve this mission the commission administers state and lottery-funded student financial aid programs including the HOPE Scholarship and HOPE Grant and provides college planning and other educational services to more than 2 million Georgians through GAfutures.org. The commission seeks to improve its own operations and inform policymakers and other stakeholders through analysis, interpretation and publication of information using the extensive data collected in support of its programs.

We offer excellent benefits including 13 paid holidays, 3 weeks annual + 3 weeks sick leave per year, health/life/disability benefits after 30 days, employer 401k match, medical/childcare spending account options, and deferred compensation plan. Our standard business hours are Monday through Friday from 8am to 5pm. We also offer employee recognition and a great place to work! Our office is conveniently located in Tucker only 2 minutes from I-285.

Working under broad supervision, the Chief Information Security Officer is the leader of the corporate information security function for the Georgia Student Finance Commission, to include responsibility for overall corporate security strategy and security architecture planning and development. The scope of this role covers all utilized security technologies and services, including protection services, perimeter defenses, physical and logical access control, and profile management of all employees and contractors.

As the company's senior security officer, the incumbent also has enterprise-level responsibility for all data/information security policies, standards, evaluations, roles, and corporate awareness.

The incumbent will work with Information Technology, Internal Compliance / Risk Management, Human Resources, operational groups, and users in the development and implementation of an IT security strategy designed to provide a high level of information security while preserving and enhancing system processes and usability. The individual must be a results-oriented person who can achieve tangible improvements in the corporate security arena.

Excellent technical and communications skills are a must, as well as proven security leadership experience. The incumbent will be responsible for staff security and awareness training.

Job Responsibilities:

• Develop, implement, and manage the overall enterprise process for security strategy and associated architecture and engineering standards.
• Develop and implement policies, standards, and guidelines related to corporate security.
• Oversee the continuous daily monitoring and protection of information systems.
• Design and implement security controls across on-premises and cloud environments (IaaS, PaaS, SaaS), with a focus on data residency, data loss prevention, identity-centric security, and access governance across platforms such as Microsoft 365/Azure and AWS.
• Drive the responsible adoption of emerging technologies, including artificial intelligence, by evaluating AI risks and value and integrating agentic, AI-driven threat detection into agency workflows.
• Develop and manage an Incident Report and Response System to address organization security incidents (breaches), responding to alleged policy violations, or complaints from external parties. Serve as the enterprise focal point for security incident response planning and execution.
• Evaluate suspected security breaches and recommend corrective actions (including incidents involving outside vendors).
• Partner with Internal Compliance / Risk Management to design, implement, and manage a comprehensive Governance, Risk, and Compliance (GRC) program.
• Lead continuous information security risk assessments that identify and classify critical assets, evaluate associated threats and vulnerabilities, and drive the implementation of risk mitigation controls.
• Serve as compliance officer with respect to state and federal information security policies and regulations, working with Internal Compliance / Risk Management as necessary.…