Chief Information Security Officer | Enterprise Information Security

GENERAL DESCRIPTION

The CISO leads the Office of the Attorney General’s (OAG) information security program, setting vision and strategy to protect information assets, systems, and infrastructure. This role partners with internal divisions, state and federal agencies, and vendors to implement best‑class security practices aligned with policies and standards.

Key responsibilities include:

• Developing, maturing, and executing OAG’s cybersecurity strategy and program.
• Advising the Office of the CIO on security risks and acceptable risk levels.
• Overseeing cybersecurity operations, risk management, and incident response.
• Embedding security into digital transformation initiatives, including cloud expansion and modernization.
• Driving adoption and enforcement of security policies and procedures.
• Leading a high‑performing team of security professionals.

The ideal candidate demonstrates servant leadership, fosters collaboration, and proactively addresses emerging threats. This position reports to the CIO and supports OAG’s mission to deliver secure, high‑quality technology services for Texans.

The OAG is a dynamic state agency with over 4,000 employees throughout the State of Texas, and is committed to providing innovative, modern, and value‑driven IT services to the agency. We believe that having talented people in the right place while effectively utilizing new tools and technologies enables us to empower the agency to best serve the people of Texas. OAG employees enjoy excellent benefits ((Use the "Apply for this Job" box below).)

along with tremendous opportunities to do important work at a large, dynamic state agency making a positive difference in the lives of Texans.

• Leads the agency’s information security function to ensure consistent, high‑quality security management aligned with agency goals and the protection of information assets, technologies, applications, systems, infrastructure, and processes.
• Establishes and enforces cybersecurity standards, policies, and procedures to maintain service continuity during changes, security incidents, or disaster recovery events.
• Develops and oversees a strategic, comprehensive information security program ensuring confidentiality, integrity, availability, privacy and recovery of organizational information assets.
• Operates and manages the Security Operations Center (SOC) to monitor infrastructure for cyber threats, including external attacks and insider risks.
• Builds and leads a skilled team of security professionals responsible for risk reduction, incident response, and collaboration with business and technical stakeholders during cyber events.
• Directs threat intelligence collection, analysis, and dissemination to internal teams and partner organizations to strengthen cybersecurity posture.
• Conducts security assessments, risk analyses, and audits; defines and maintains security standards and compliance requirements.
• Represents the agency in internal and external forums on information security strategy and represents information security in IT and executive governance committee.
• Oversees security awareness, communication, and training programs to promote a strong security culture across the organization.
• Performs related work as assigned
• Maintains relevant knowledge necessary to perform essential job functions
• Attends work regularly in compliance with agreed‑upon work schedule. Telework schedules are permitted for employees based on the agency’s approved Telework Plan (if schedule does not adversely affect operations and service levels, and standard hours of operation are maintained). Telework schedules are set by the Departments based on business needs.
• Ensures security and confidentiality of sensitive and/or protected information
• Complies with all agency policies and procedures, including those pertaining to ethics and integrity

• Education:
  
  Graduation from high school or equivalent
• Education:
  
  Graduation from an accredited four‑year college or university with major coursework in cybersecurity, information technology, computer engineering, computer information systems, computer science, management information…