Chief Information Security Officer CISO

Chief Information Security Officer (CISO) / Head of Information Security Overview

We are seeking an experienced Information Security Leader to define and execute a comprehensive enterprise security strategy. This role is responsible for safeguarding systems, data, and infrastructure while ensuring compliance with federal, state, and industry regulations.

The ideal candidate will bring deep expertise in security governance, regulatory compliance, cloud security, and incident response, along with a proven ability to lead large‑scale security programs in complex, high‑compliance environments.

This position is on site 3 days a week in the Phoenix office.

• Develop, implement, and maintain an enterprise-wide information security strategy aligned with business objectives and customer commitments.
• Establish and oversee security governance frameworks, including policies, standards, and procedures across the organization.
• Serve as a strategic advisor to executive leadership, providing regular updates on security posture, risks, and program maturity.
• Define and track key security metrics, KPIs, and risk indicators; report findings to senior leadership and stakeholders.
• Manage the information security budget, including planning, forecasting, and justification of investments.
• Evaluate and implement advanced technologies, including AI-assisted security tools, to enhance detection, response, and automation capabilities.

• Lead compliance initiatives for CJIS Security Policy
  , including transition to CJIS 6.0 standards (e.g., phishing-resistant MFA, FIPS 140-3 encryption, updated cloud controls).
• Manage FedRAMP authorization and continuous monitoring (Con Mon) efforts, including coordination with third‑party assessors, vulnerability management, and audit readiness.
• Oversee SOC 2 Type II and ISO 27001 ISMS programs, including audits, risk management, and continuous control validation.
• Ensure compliance with data privacy, residency, and sovereignty requirements applicable to government and regulated industries.
• Monitor evolving regulatory requirements and proactively align security programs to maintain compliance.
• Oversee cyber insurance coverage and collaborate with legal teams on contractual security obligations and breach response requirements.
• Act as the primary point of contact for security audits, client assessments, and compliance questionnaires.
• Support business development efforts, including RFP/RFI responses and client security discussions.

• Develop, maintain, and test the incident response program
  , including tabletop exercises and simulations.
• Establish or oversee Security Operations Center (SOC) capabilities, including SIEM tools, 24/7 monitoring, and threat detection.
• Lead response efforts for security incidents and breaches, serving as the primary decision‑maker during active events.
• Oversee vulnerability management, penetration testing, and threat intelligence programs.
• Manage relationships with external security vendors, service providers, and relevant authorities.
• Ensure timely and compliant breach notification processes.

• Design and deliver an enterprise‑wide security awareness and training program tailored to organizational and regulatory requirements.
• Promote a culture of security awareness across all departments.
• Develop specialized training for technical teams, including secure coding and data protection practices.
• Track program effectiveness and continuously improve training initiatives based on evolving threats.

• Collaborate with engineering, product, and Dev Ops teams to embed security‑by‑design principles across the development lifecycle.
• Review and approve security architectures for applications, infrastructure, and new initiatives.
• Oversee identity and access management (IAM), encryption standards, data classification, and data protection controls.
• Ensure strong cloud security posture, including secure configuration and monitoring of cloud environments and services.
• Lead application security (App Sec) initiatives, including code scanning,…