Chief Information Security Officer

Chief Information Security Officer

Job no: 561994
Work type:
Management (MPP)

Location:

Channel Islands
Categories: MPP, At-Will, Full Time, Information Systems & Technology, On-site (work in-person at business location)

Information Technology Services

Administrator II

RESPONSIBILITIES & DUTIES:
Recognized as the University Information Security, Risk, and Policy Officer (ISO/CRO/CPO) and is responsible for all duties assigned in that capacity. Maintains and administers the University Information Security Program and provides leadership in establishing and maintaining University security architecture, controls, policies, standards, processes, and procedures. Provides regular overall assessment of University security posture, operation of existing controls, and progress on improvements using metrics and reporting available to CIO, IT Leadership, and University Leadership.

Performs activities required by CSU, federal, state, or other regulations to achieve or maintain University compliance. Provides an annual and scheduled review of University procedural documents related to information security, compliance, and risk management; maintains and administers the University Information Security Awareness Program; maintains and administers procedures and documentation supporting security, risk management and compliance. Collaborates with system-wide Information Security Council (ISC) on matters related to CSU system compliance and risk.

Policy:
Coordinate the development of CSU Channel Islands information security policies, standards, and procedures. Work with key ITS offices, data custodians, and governance groups in the development of such policies. Ensure that university policies support compliance with system and external requirements. Oversee the dissemination of policies, standards, and procedures to the university community.

Education and Training:
Coordinate the development and delivery of an education and training program on information security and privacy matters for employees, students, and other authorized users.

Compliance Enforcement:
Serve as the university compliance officer with respect to CSU Channel Islands, state, and federal information security policies and regulations. Work with the campus designated FERP A, Records Access, and HIP AA privacy officers on compliance issues as necessary. Prepare and submit required reports to external agencies.

Risk Assessment and Mitigation:
Develop and implement an ongoing risk assessment program targeting information security and privacy matters. Provide academic and business units with security risk assessments and provides or assist with the development, deployment, and monitoring of protective measures. Work with the CIO, appropriate IT committees, University executives, Deans, and top administrators in administrative departments and divisions to ascertain University security priorities. Work with the CIO to set a budget and advise on funding issues for identified priorities.

Direct multiple complex security development projects and manages security systems so that the day-to-day IT functions of the University supporting teaching, learning, scholarship, and administration can work securely.

Incident Prevention and Response:
Oversee the monitoring of security controls and provide metrics and reporting to ensure controls are performing as designed and action is taken to correct deficiencies. Develop, implement, and maintain an Incident Reporting and Response Process to address security incidents, breaches, policy violations, or complaints from external parties. Serve as the official campus contact point for information security, privacy, and copyright infringement incidents, including relationships with law enforcement entities.

Technical:
Monitor and evaluate data from sources of security event information and/or network logs to promptly identify, evaluate, and respond appropriately to information security incidents that impact the information infrastructure at Channel Islands; provide regular assessments of Cl's information security operations to provide metrics of efficacy; may be called upon to mobilize and participate in incident handling on short notice during off-shift hours;

contribute to the security systems design process; draft formal incident reports; contribute to the preparation of vulnerability reporting metrics, threat intelligence, and other analysis; interfaces with other key stakeholders to facilitate coordinated security operations; assist in security thought…