Chief Information Security Office; CISO

Position: Chief Information Security Office (CISO)

At Weyerhaeuser, our IT team is on a mission to transform the timber industry. We are industry leaders in forest products and our customers are at the heart of everything we do. We’re not just in the cloud, we’re implementing technology that will keep us at the forefront of innovation in the forest products industry. We’re using AI to create new ways of bringing exciting products to our customers and we sustainably manage forests and manufacture products that make the world a better place.

We’re serious about safety, driven to achieve excellence, and we proudly invest in the communities we are part of. With multiple business lines in locations across North America, we offer a range of exciting career opportunities for smart, talented people who are passionate about making a difference.

The Chief Information Security Officer (CISO), working in collaboration with Weyerhaeuser’s strategic initiatives, is an executive responsible for protecting our people, data, reputation, and manufacturing business operations by leading a business-aligned information security and cybersecurity program. This role sets the strategic direction for the security governance, risk management, incident response, third-party security, data protection, and security awareness programs.
Operating as a trusted advisor to Weyerhaeuser’s executive leadership team, the CISO ensures the confidentiality, integrity, and availability of secure data while enabling innovation, responsible AI adoption and operational resilience. The CISO works closely with the business community and IT to provide objective risk oversight, policy leadership, executive reporting, and continuous improvement of Weyerhaeuser’s security posture. The CISO is responsible for creating a strategy to ensure our cybersecurity programs aligns with the company’s commitment to sustainability and operational resilience.

The CISO is also responsible for identifying, evaluating and reporting on legal and regulatory, IT, and cybersecurity risk to information assets, while supporting and advancing business objectives. This role reports to the CIO who is accountable for enterprise IT, data, AI, and cyber security.

Responsibilities

• Enterprise Cybersecurity Strategy and Leadership

  • Develop an information security strategy that is aligned to growth initiatives, organizational priorities and enables achievement of the organization's business objectives while minimizing risks.

  • Design, implement and manage a strategic, comprehensive information security program to ensure appropriate levels of confidentiality, integrity, availability, safety, privacy and recovery of information assets owned, controlled or/and processed by the organization.

  • Align cybersecurity investments and priorities with enterprise risk appetite, regulatory demands, and business strategy.

  • Serve as key advisor to Weyerhaeuser’s senior executives on cyber risk, emerging threats, and security-related business impacts.

  • Translate technical security requirements into actionable business-focused plans across the enterprise.

  • Monitor industry trends, threat intelligence, and emerging technologies to inform strategic direction.

• Risk Management, Governance and Compliance

  • Drive the development and enforcement of enterprise-wide cybersecurity policies, standards, and frameworks.

  • Ensure compliance with relevant legal and regulatory frameworks.

  • Lead enterprise cybersecurity risk assessments and guide business units in risk treatment planning.

  • Engage with internal audit, legal, finance, and compliance teams to manage regulatory obligations and audit readiness.

  • Promote accountability and transparency through structured governance and reporting mechanisms.

• Security Architecture

  • Provide leadership and strategic oversight for security…