Scheduled Hours

40

Position Summary

The Associate CISO for Research, Teaching & Learning supports university researchers and instructors to enable the secure use of information technology in research activities and teaching functions, ensuring compliance with information security contractual and regulatory obligations.

Primary responsibilities include the creation and maintenance of information security policies, leading cyber risk assessments, operating an effective information security program, and overseeing a team of information security professionals who together, maintain effective relationships and exert influence with key stakeholders across the campus. The position has secondary reporting relationships to the Deputy Chief Information Officer - Research, Clinical and Medical Education Technologies and the Deputy Chief Information Officer - Administrative and Academic Technologies.

Eighty percent of the Associate CISO for Research, Teaching & Learning’s time is expected to focus on Research, with 20 percent focused on Teaching. The Associate CISO for Research, Teaching & Learning is a key member of the Information Security team with leadership responsibility for information security in research and instructional systems including policy, compliance, audit, outreach, education, and training across the University. The position is a key collaborator and trusted advisor to University Information Technology leadership across the enterprise.

Job Description

Primary Duties & Responsibilities:

Research Policy, Compliance and Security Engagement and Leadership

• Provide critical leadership, support and guidance to research initiatives that require technology-related DoD CMMC Certification or regulatory compliance with DFARS 7012, NIST 800-171, NIST 800-53, export control and Common Rule of Human Research.
• Collaborate with research sponsors to define and direct security assessments, requirements, reviews and remediation recommendations.
• Define the strategy for technology related regulatory compliance impacting research at the University.
• Monitor and report the changes in regulatory requirements impacting research and refine strategies to address these changes. Keep University Chief Information Security Officer and other key stakeholders fully appraised of all changes and directions.
• Define and lead education and communication practices for the Research Community and IT on the overall approach and required action to be compliant to these technology-related regulations.

Outreach, Education and Training

• Work closely with senior IT leaders, technical experts, deans and administrative leaders across the University to provide them with an in-depth understanding of the wide variety of research-related security issues, and their required responsibilities.
• Create and deliver education and awareness programs, which inform and advise faculty and staff at the school and department on security issues, best practices, and vulnerabilities.
• Establish and deliver an ongoing program, which specifically relates to the extramural research funding agencies, and the regulations and requirements that pertain to their unit's research areas.
• Work with University-wide IT staff on an ongoing basis to build and maintain awareness and understanding of their responsibilities pertaining to information security.

Program Oversight

• Coordinate with University project managers and information security management teams to assess current project timelines that have tasks that impact information security resources.
• Oversee, and track all information technology and security-related audits including scope of audits, colleges/units involved, timelines, auditing agencies and outcomes.
• Lead the team that responds to third-party audits of research information security, mobilizing the Security and other IT professionals from around university.
• Monitor and report the overall resource constraints and task due dates to provide leadership a dashboard of information security utilization and involvement in the University.

Manage a Team of Information Security Professionals

• Manage a team within the University Office of Information Security, consisting of direct and indirect reports. This includes hiring, training, staff development, performance management and annual performance reviews.
• Develop the information security organization’s talent, engaging / managing third parties as needed to ensure the required capabilities are available either internally or externally.
• Coordinate the use of external resources involved in the information security program, including, but not limited to,