Information Security Officer

• Develop, implement, and maintain agency-specific information security policies and procedures to ensure alignment with the Kansas Information Security Office (KISO) strategy and applicable laws, regulations, and frameworks (e.g., NIST CSF, NIST 800-53).
• Lead risk management activities including risk assessments, mitigation planning, and third-party/vendor risk evaluations to protect agency data, systems, and infrastructure.
• Serve as the primary liaison between the agency and KISO, communicating and implementing statewide cybersecurity initiatives while balancing agency-specific operational needs.
• Conduct compliance assessments and support audits related to federal, state, and contractual security requirements, including CJIS, HIPAA, IRS Pub 1075, and others.
• Collaborate with agency leadership and technical teams to provide strategic guidance and ensure security is integrated into all business operations and IT projects.
• Respond to security incidents by coordinating with internal and external stakeholders to manage investigation, containment, and recovery, followed by root cause analysis and improvement plans.
• Provide security awareness training and consultation to agency staff to promote a strong security culture and ensure understanding of security policies and practices.

• Strong working knowledge of security frameworks such as NIST CSF or NIST 800-53.
• Ability to develop and implement policies and procedures, and to present security strategies to both technical and non-technical audiences.
• Effective communication skills, with the ability to convey complex security concepts in simple terms to technical and business stakeholders.
• Strong leadership and project management skills, with the ability to prioritize tasks in a fast-paced environment.
• Ability to assess regulatory requirements and determine whether existing controls meet those requirements.
• Proficient in reading and comprehending technical information related to software, hardware, and telecommunications systems.

Eleven (11) years’ direct experience relative to the field of work, with at least three (3) years of direct experience in information security.

• One or more cybersecurity certifications (CISSP, CISM, CISA) or must obtain within one year.
• Familiarity with government and public sector environments
• Knowledge of state and federal regulations such as CJIS, HIPAA, and IRS Pub 1075.