Assistant Vice President, Information Security

Assistant Vice President, Information Security

R0010816

Tampa

Information Technology and Security at The University of Tampa has a position available for an Assistant Vice President, Information Security, reporting to the Vice President, Information Technology and Security. The AVP is responsible for assisting the VP information Technology & Security (CIO/CISO) with establishing and executing a multi-year security strategy that protects students, faculty, staff, and institutional data in a threat landscape increasingly shaped by artificial intelligence, identity-based attacks, and third-party risk.

This role handles executive duties such as briefing cabinet or board members, leading the ITS CCIRT team and major incident investigations in a collaborative team environment. It calls for a keen understanding of the intersection between business, academic and security requirements as well as evaluating technology solutions that departments wish to purchase, setting risk-based criteria that enables innovation and productivity.

Additionally, this position leads or participates in audits, conducts risk assessments, and creates corrective actions or improvements to optimize the information security program, procedures, or data protection.

This is a strategy-first leadership role. The AVP leads the Information Security department and the university's certified ISO/IEC 27001 Information Security Management System (ISMS), but success in this position is measured by the ability to anticipate where risk is moving, align security investments with institutional priorities, and communicate clearly with executive-level audiences - not solely by day-to-day operational execution, which the AVP is expected to build a team capable of running.

This position is designated as an essential employee and may be required to report to work as scheduled when university offices are closed due to severe weather or other conditions.

• Owns and maintains the university's multi-year information security strategy and roadmap, aligning it with institutional goals, the enterprise risk register, and the realities of a private, residential, four-year university environment.
• Sets and sequences security priorities using risk-based judgment: distinguishing the initiatives that require the AVP's direct leadership from those that should be delegated to capable staff and empowering the team accordingly.
• Communicates security posture, risk trends, and program progress to the VP and Cabinet-level audiences in clear, non-technical, decision-ready terms.
• Integrates security considerations into strategic and tactical planning, budget preparation, and major initiatives across ITS and the university - acting as a partner in enabling institutional goals, not a gatekeeper.
• Develops the annual security budget and multi-year investment plan, making defensible trade-off recommendations and demonstrating return on security investment.
• Continuously scans emerging threats, technologies, and higher education security trends, translating them into concrete, prioritized action for the university.

• Partners with university AI governance efforts, contributing security expertise to AI acceptable use policy, data classification guidance for AI tools, and the review and approval of AI platforms and integrations.
• Builds and matures defenses against AI-enabled threats, including AI-generated phishing, deepfake-driven social engineering and fraud, and automated credential attacks.
• Assesses the security implications of enterprise AI adoption - including generative AI platforms, AI agents, and AI features embedded in existing vendor products - and establishes controls proportionate to institutional risk.
• Evaluates and adopts the responsible use of AI within the security program itself, including AI-assisted detection, response, and security awareness capabilities.
• Leads third-party and vendor AI risk review as part of the university's technology approval and procurement processes.

• Coordinates the development, implementation, and administration of security policies, standards, and programs for ITS and other areas of the university as applicable.
• Leads the Computer Security Incident Response Team (CSIRT) and co-leads the Business Continuity Emergency Incident Response Team (BCEIRT), ensuring plans are tested, current, and understood.
• Oversees a modern defensive posture spanning identity and access management, cloud and SaaS security, endpoint protection, email security, data loss prevention, and vulnerability management, with progress toward zero trust principles.
• Coordinates the assessment of systems and network security risks, including risk analysis, threat assessments, and contingency planning.
• Completes incident reports and investigations of policy violations and suspected material incidents, including any required regulatory notifications.
• Participates in project development…