VCISO

Overview

The vCISO acts as a senior cybersecurity advisor for assigned clients, guiding them in establishing and maintaining a robust information security posture. This role provides strategic leadership in assessing risk, ensuring compliance with regulatory standards (HIPAA, NIST, ISO, and advising on security architecture, policy, and incident response planning. The vCISO serves as an extension of the client’s leadership team, translating complex security concepts into actionable business outcomes while coordinating with internal delivery teams to ensure execution.

This position is exempt and remote.

Responsibilities

• Security Governance & Strategy
- Develop and maintain client security strategies and governance frameworks aligned with business objectives.
- Define and implement information security policies, standards, and procedures.
- Ensure security programs align with recognized frameworks (NIST, ISO 27001, CIS Controls).
- Oversee risk assessment programs, establishing priorities and mitigation plans.
- Serve as the client’s trusted security advisor, translating technical risk into business language.

• Risk Management & Compliance Oversight
- Conduct regular risk assessments, gap analyses, and compliance audits for assigned clients.
- Lead the development and monitoring of remediation plans and risk mitigation strategies.
- Ensure alignment with regulatory standards (HIPAA, SOC 2, PCI-DSS, GDPR, etc.).
- Coordinate third-party vendor assessments and ensure supply chain security compliance.
- Provide guidance for audit readiness and documentation of compliance evidence.

• Client Partnership & Advisory Leadership
- Act as the primary security point of contact for assigned clients.
- Conduct quarterly and annual security reviews with client executives.
- Advise clients on security investments and technology roadmaps to reduce risk exposure.
- Collaborate with Account Managers and Service Delivery Directors to ensure integrated client outcomes.
- Support client education and awareness initiatives to promote a culture of security.

• Incident Response & Risk Mitigation
- Develop and oversee incident response plans (IRPs) for clients.
- Serve as a key escalation point during major security incidents or breaches.
- Ensure post-incident reviews identify and address root causes.
- Partner with SOC and Security Operations teams to validate incident containment and recovery.
- Provide executive reporting and communication during security events.

• Security Program Development & Standardization
- Drive consistency in security operations frameworks across all clients.
- Contribute to the design and improvement of standardized vCISO methodologies and templates.
- Define and monitor KPIs/KRIs for client programs.
- Collaborate with the ITIL Methodology Manager to align security processes with ITIL practices.
- Ensure internal and client-facing teams adhere to security policy compliance standards.

• Reporting, Metrics & Continuous Improvement
- Develop and present executive-level security dashboards and risk reports.
- Measure performance against established risk reduction and compliance objectives.
- Track and report on audit findings, incident metrics, and remediation progress.
- Identify opportunities for improvement in client and internal security processes.
- Promote ongoing innovation and improvement in the MSP’s security service offerings.

Experience & Qualifications

• 10+ years of progressive experience in cybersecurity, risk management, or information assurance.

• Demonstrated experience acting as a CISO or senior security leader across multiple clients or business units.

• Strong knowledge of security frameworks (NIST CSF, ISO 27001, CIS Controls, HIPAA).

• Excellent understanding of governance, compliance, and risk management methodologies.

• Exceptional communication and presentation skills with the ability to interface at the executive level.

Preferred

• Experience with in a Managed Security Services Provider (MSSP) or MSP environment.

• Bachelor’s degree in Cybersecurity, Computer Science, or equivalent experience.

• Relevant certifications such as CISSP, CISM, CRISC, or ISOLead Implementer.

• Knowledge of cloud security models…