Chief Information Security Officer

Compensation Range:

$103,077.00 - $154,596.00

Our full-time positions come with an array of excellent benefits including comprehensive healthcare coverage, a pension plan, flexible spending accounts and even a tuition reimbursement program.

At Lancaster County, we understand the importance of work-life balance. That's why we offer paid time off for sick, vacation and holidays, an employee assistance program, and family medical leave.

If you're passionate about making a difference, apply today to join us in serving the community!

Job Description:

JOB SUMMARY

• The Chief Information Security Officer (CISO) provides strategic leadership and oversight of the County’s enterprise cybersecurity, information security, risk management, and cyber resilience programs. Working closely with the CIO and Deputy CIO, the CISO is responsible for protecting County information, technology systems, networks, applications, cloud services, and other digital assets from cybersecurity threats and ensuring appropriate safeguards are established across County operations.

• The CISO develops and maintains Countywide cybersecurity policies, standards, and security architecture; assesses and manages cybersecurity risk; oversees vulnerability management and security monitoring; directs cybersecurity incident response; evaluates third-party and emerging technology risks; and advises County leadership regarding cybersecurity threats, risks, regulatory requirements, and recommended mitigation strategies.

• The position provides leadership and oversight for compliance with applicable cybersecurity, privacy, and information-protection requirements, including CJIS, HIPAA, and other federal, state, and local requirements. The CISO also develops and oversees the Countywide security awareness and training program and coordinates cybersecurity activities with County departments, technology providers, government partners, law enforcement, and other external organizations.

• The CISO provides cybersecurity oversight for the County’s business continuity and disaster recovery programs and coordinates with County departments to promote organizational resilience and continuity of critical technology services.

• This position is designated essential and may be required to respond to cybersecurity incidents, technology outages, natural disasters, or other emergencies outside normal business hours and when County offices are closed.

REPORTING RELATIONSHIPS

• The Chief Information Security Officer supervises a staff of Security Technicians, Systems & Security Engineers, and IT Security Analysts.

• The Chief Information Security Officer reports directly to the Chief Information Officer.

ESSENTIAL JOB FUNCTIONS

• Develop, implement, maintain, and enforce Countywide cybersecurity and information security policies, standards, procedures, and technical security requirements consistent with the strategic direction established by the CIO.

• Lead the County’s cybersecurity and information security program, including security governance, risk management, security architecture, vulnerability management, threat detection, incident response, identity and access security, data protection, and security awareness.

• Identify, assess, prioritize, and communicate cybersecurity risks and vulnerabilities and coordinate appropriate mitigation, remediation, or risk acceptance with IT leadership, County departments, and other stakeholders.

• Direct and coordinate the County’s response to cybersecurity incidents, including investigation, containment, recovery, documentation, notification, and coordination with executive leadership, law enforcement, government partners, insurers, and other external organizations as appropriate.

• Provide leadership and oversight for compliance with applicable cybersecurity, privacy, and information-protection requirements, including CJIS, HIPAA, and other federal, state, and local requirements.

• Develop, implement, and maintain a Countywide cybersecurity, privacy, and HIPAA security awareness and training program, including phishing preparedness and role-based security education.

• Establish security requirements and provide cybersecurity review and guidance for new systems, applications, cloud services, infrastructure, integrations, and emerging technologies, including artificial intelligence.

• Oversee third-party cybersecurity risk, including security assessments of vendors, contractors, hosted services, and technology providers and the development and review of appropriate contractual security requirements.

• Develop and maintain cybersecurity incident re