Chief Information Security Officer

Job Title: Chief Information Security Officer (CISO)

Type: Full-Time, Exempt

Reports To: Chief Executive Officer

Direct Reports: None s role leads through governance authority, clear standards, and cross-functional partnership.

Compensation: $155k to $190k base, plus full benefits: medical, dental, vision, 401(k) match, and generous PTO.

The Chief Information Security Officer (CISO) leads DTC's security strategy, governance, and risk posture, both to protect the business as we scale and to enable growth into regulated industries.

This is a dual-facing role. Internally, the CISO owns DTC's own security governance, compliance readiness, incident preparedness, and third-party risk. Externally, the CISO is the security and compliance authority our clients meet: the person who can sit with a DoD contractor or a regulated prospect, scope what they actually need, and stand behind the answer. Because DTC manages client systems that handle Controlled Unclassified Information, our own environment sits inside our clients' assessment scope.

This role is accountable for both sides of that boundary.

The CISO also leads the expansion of DTC's CMMC and non-dental service line, including the development of a consulting practice supporting DoD contractors and other regulated clients. This is a build role, not a caretaker role. In the early stage the CISO will personally write policy, define scope, and produce evidence artifacts before there is a team to delegate that work to.

This role is critical to DTC's long-term ability to grow revenue, increase profitability, scale responsibly, and build credibility in compliance-driven markets.

• Security Strategy, Governance, and Risk Leadership
  • Own the company-wide security strategy, standards, and security roadmap.
  • Define and maintain security governance policies and controls.
  • Lead risk assessment and mitigation planning across systems and operations.
  • Maintain a living risk register with named owners, treatment decisions, and review cadence.
  • Define acceptable vs unacceptable risk thresholds and enforce that discipline.
  • Own DTC's security awareness and training program, including phishing simulation and role-based training.
  • Report security posture, risk, and compliance status to the Executive Team on a defined cadence, in business terms.
  • Own the security content of client contracts, security questionnaires, and cyber insurance applications.
  • Ensure DTC maintains a strong, scalable security posture as the business grows.
• Internal CMMC Compliance Leadership
  • Lead DTC's internal CMMC compliance effort in partnership with external compliance consultants.
  • Define and defend DTC's CUI boundary and assessment scope.
  • Own the System Security Plan (SSP) and Plan of Action and Milestones (POA&M) as living documents, not one-time deliverables.
  • Drive documentation, control implementation oversight, and evidence readiness.
  • Maintain accountability for internal compliance milestones and audit readiness.
  • Own the annual affirmation and ongoing monitoring obligations once certified.
  • Translate internal compliance learnings into repeatable best practices for client delivery.
• CMMC and Non-Dental Growth, Consulting Practice Leadership
  • Lead the growth and structure of DTC's regulated-industry consulting service line.
  • Own delivery frameworks for CMMC readiness support (process, scope, standards, outcomes).
  • Define the tiered service offering and the scoping discipline that has to precede any fixed-fee proposal.
  • Own the Customer Responsibility Matrix for every engagement: which controls DTC holds, which the client holds, and which are shared.
  • Oversee CMMC client engagements in partnership with the technical team.
  • Select and own the compliance platform that makes multi-client evidence management scalable.
  • Build and maintain relationships with independent C3
    
    PAO firms, holding the line that DTC advises and does not assess the same client.
  • Evaluate and pursue formal ecosystem standing (for example Registered Provider Organization designation) where it earns market credibility.
  • Support discovery and prospect trust-building as the security and compliance authority.
  • Scale the service line toward the first $1M non-dental revenue milestone as a maturity threshold, and support growth beyond it.
• Incident Readiness and Security Escalation Leadership
  • Own incident response planning, readiness standards, and escalation protocols.
  • Lead security-related incident triage and coordinated response.
  • Run tabletop exercises at least annually for DTC and, where scoped, for regulated clients.
  • Own breach notification decisions and regulatory reporting obligations, working with counsel and insurance.
  • Ensure post-incident review discipline and ongoing prevention improvements.
• Vendor Security Reviews and Third-Party Risk Management
  • Define vendor security requirements and compliance thresholds.
  • Review vendor posture and documentation (SOC reports, attestations, control maturity).
  • Approve, deny, or approve with conditions based on risk.
  • Maintain vendor…