Cyber Risk Culture Strategist

Overview

This position is responsible for the ground-up creation, leadership, and management of the State of Wyoming's Enterprise Cyber Security Awareness Program. The primary objective is to move beyond "compliance-based" training to a behavioral-driven security culture that treats the human element as a critical security control. This role collaborates in the state's strategy for phishing defense, including assisting with the Tier 1 investigation and triage of reported threats (Report Phish) when schedule allows.

Additionally, this position is the architect of the Wyoming Cyber Risk Score—a comprehensive framework designed to quantify and visualize security risk at the individual, division, and agency levels. By integrating commercial tools with open-source data, this role provides the CISO and executive leadership with a real-time risk profile of the state's workforce and infrastructure, ensuring that security policies are not only understood but effectively operationalized.

Working for the State of Wyoming offers more than a paycheck. Our total compensation package includes:

• Comprehensive health, dental, and vision insurance
• Paid vacation, sick leave, FMLA, and holidays
• Retirement - Pension and 457B plans that help you build a secure future
• Flexible schedules and work-life balance options
• Meaningful work that makes a difference for Wyoming communities

Note:

details beyond salary are available in the Total Compensation Calculator and related resources.

• Cyber Security Awareness Program Creation & Leadership: Design and execute the ground-up creation of a statewide security culture program. Move beyond standard phishing tests to implement behavioral psychology-based training, social engineering simulations, and targeted awareness campaigns. Establish KPIs to measure cultural shifts and reductions in human-centric security incidents.

• Cyber Risk Scoring Framework Development: Research, develop, and deploy the "State of Wyoming Cyber Risk Score." Build a scoring model that aggregates data from people, divisions, and agencies using commercial GRC tools and open-source integrations. Create dashboards to visualize the state's risk posture for executive and legislative reporting.

• Policy Integration & Strategic Advocacy: Deep-dive into Wyoming state security policies to translate technical mandates into actionable awareness content. Ensure that all training initiatives are rooted in actual state policy requirements, making the security rules understandable for the general workforce.

• Vendor & Platform Management: Manage relationships with security awareness and risk management vendors. Oversee the technical administration of awareness platforms, ensuring 100% participation across all state agencies and addressing technical barriers to deployment.

• Phishing Response & Tier 1 SOC Triage: Manage the "Report Phish" phishing simulation program and assist with enterprise phishing intake, initial investigation and triage of reported suspicious emails, identifying malicious attachments and URLs. Coordinate with the security operations team to block emerging threats and provide feedback to reporting users.

• Preference may be given to those with experience in Cyber Security Awareness training.
• Preference may be given to those with experience in creating and managing awareness programs.
• Preference may be given to those with experience in working with cyber security teams.
• Preference may be given to those with experience in statistical analysis.
• Preference may be given to those with experience in management, analysis, design, monitoring, and support of cyber security awareness programs.
• Preference may be given to those with experience in managing tabletop exercises.
• Preference may be given to those with consulting and communication with contract consultants, vendors, local network administrators, peers, and all levels of management.

• Program Creation: Proven track record of building a security culture in a large organization.
• Risk Modeling: Knowledge of how to build risk-scoring frameworks using various data inputs.
• Technical Triage: Basic SOC-style skills for assisting with investigating…