Chief Information Security Officer
Location: Columbia, MD
Duration: 12 months extendable.
Visa: Open
Job Description:
The candidate must possess at least 10 years of experience in
IT security-related roles such as security analyst, network administrator, or
similar positions.
Leadership: The Contractor must possess experience in management or
leadership roles as CISOs need to lead teams and make strategic decisions.
Perform a detailed cyber risk assessment that includes the following, but not limited to:
Identifying, estimating, and prioritizing information cyber security risks ;
Examining HCC's current technology, security controls, policies, and procedures to
assess potential threats or attacks; and
Evaluating HCC's threat landscape, vulnerabilities, and cyber gaps that pose a risk to
its assets.
B. Act as HCC's Qualified Individual (QI) to present quarterly reports to HCC Board of
Trustees and leadership as required and specified by GLBA.
C. Develop an information security program using a framework such as National Institute of
Standards and Technology (NIST) 800-53, Center of Internet Security (CIS) Critical
Security Controls, or CIS Implementation Group 1 (IG1) that protects HCC in accordance
with GLBA security requirements.
D. Provide information security leadership, communication, investigation, mitigation,
containment and post-incident analysis in the event of a cyber incident.
E. Update and enhance existing cybersecurity policies and procedures as required by GLBA.
The policies include but not limited to:
1. Vulnerability management
2. Data management
3. Incidence response
4. Software management
5. Hardware asset management
F. Provide guidance when analyzing real-time threat analysis identified by HCC's security
operations center.
G. Perform third-party and partner evaluations Higher Education Community Vendor
Assessment Toolkit (HECVAT).
H. Develop and implement the strategy to conduct regular security audits and assessments to
identify vulnerabilities and ensure compliance with security policies.
I. Write a clear and concise incident response plan that meets industry standards.
J. Participate in meetings as needed. (i.e. weekly, monthly, quarterly, ad hoc, etc). Under
normal circumstances, in-person meetings are not required. In the event of an incident or
breach, an in-person meeting may be required.
Preferred certifications:
. Certified Information Systems Security Professional (CISSP)
Certified Information Security Manager (CISM)
Certified Information Systems Auditor (CISA)