Vice President, Information Security; CISO

About The Position

The Vice President, Information Security (CISO) is an executive leader responsible for advancing enterprise cybersecurity strategy, data protection, and digital trust within a highly regulated, publicly traded environment. This role leads the organization’s cybersecurity vision through ongoing transformation and innovation, with a focus on strengthening resilience, modernizing security capabilities, and fostering strong relationships with the Board, regulators, and key stakeholders. A critical priority for this role is leveraging AI-enabled security capabilities while proactively addressing emerging threats, including AI-driven attack vectors and evolving zero‑day risks.

The CISO partners across Technology, Product, Legal, and Finance to enable secure adoption of AI and digital innovation, while safeguarding student records and ensuring regulatory compliance.

• Lead enterprise-wide cybersecurity transformation following a significant breach, strengthening detection, response, and resilience capabilities while fostering strong relationships with regulators, the Board, and executive leadership through measurable improvements and a culture of accountability and transparency.
• Define and execute a forward-looking cybersecurity strategy aligned with enterprise risk, regulatory expectations, and business objectives, advancing a Zero Trust, data‑centric model to protect sensitive information.
• Direct enterprise vulnerability and legacy application risk management, establishing a risk-based framework to remediate, isolate, modernize, or decommission systems, while maintaining full visibility into application inventory, dependencies, and exposure.
• Build and deploy AI-augmented security capabilities, including advanced threat detection, vulnerability discovery, code analysis, and offensive testing, while defending against AI-driven threats, zero‑day vulnerabilities, and emerging attack methods.
• Integrate security into engineering and development practices by embedding secure‑by‑design principles across software development life cycle (SDLC), development, security & operations, and continuous integration/ continuous delivery (CI/CD) pipelines, and implement advanced application and application programming interface (API) security controls.
• Establish governance and controls for secure use of AI, data, and emerging technologies, ensuring strong data protection through classification, encryption, access management, and prevention of data leakage or misuse.
• Build, scale, and lead a high‑performing cybersecurity organization spanning security engineering, operations, threat intelligence, and governance, risk, & compliance (GRC), with clear accountability, performance metrics, and talent strategy.
• Strengthen security operations, incident response, and organizational resilience, including security operation center (SOC) maturity, threat hunting, crisis management, and business continuity/disaster recovery.
• Lead governance, risk, and compliance efforts, ensuring alignment with regulatory requirements and industry frameworks, integrating cybersecurity into enterprise risk management, and overseeing third‑party risk and vendor security.
• Serve as the primary advisor to the Board and executive leadership on cybersecurity risk, while managing the cybersecurity budget and investment strategy to align resources with risk reduction and business priorities.
• Select, mentor, coach and evaluate staff; establish and monitor appropriate employee performance objectives; prepare and present employee performance discussions, including one‑on‑one meetings and quarterly check‑ins; implement mentoring and coaching plans, or correction action, where appropriate.
• Perform other duties as required or apparent.

NOTE:

The Primary Accountabilities above are intended to describe the general content and requirements of the position and are not intended to be an exhaustive statement of duties. Incumbents may perform all or most of the Primary Accountabilities listed above. Specific goals or responsibilities will be documented in incumbents’ performance objectives as outlined by the incumbents’ immediate manager.