Chief Information Security Officer

POSITION DUTIES AND QUALIFICATIONS 

SUMMARY OF DUTIES:

Designs and directs a citywide information security program and partners with city leadership on risk management to provide the protection and confidentiality of data and other information assets of the city.

This job reports to: Chief Information Officer

DUTIES AND RESPONSIBILITIES:*

Position Specific Summary

The Chief Information Security Officer position at the City of Tucson’s Information Technology (IT) Department is responsible for the development and implementation of a comprehensive citywide information security program. This position manages risks, ensures data protection and compliance with legal, external, and public interest obligations.

Work is performed under the supervision of the Director of Information Technology. This position exercises supervision over cybersecurity and compliance personnel.

Duties and Responsibilities

• Develops short- and long-term strategies for optimizing the City's Information Security Plan, formulates policies to detect and mitigate threats, and advises the City Manager’s Office on data security for major IT projects. Oversees disaster recovery, business continuity, and the Cybersecurity team's budget and operations, ensuring comprehensive IT engagement and operational effectiveness. Represents the division in meetings with county, state, and advisory bodies on City data security policies and programs.

• Collaborates with risk management and leadership to establish and maintain the City's risk register to ensure effective cybersecurity risk management and accountability tracking. Oversees citywide security policies, the Written Information Security Program (WISP), and data governance, while promoting ongoing security and privacy training across all organizational levels. Sets citywide processes for protecting electronic and physical environments and leads cross-departmental efforts to address process violations and compromised data.

• Leads security management practices, designs secure architecture, and ensures compliance with policies while monitoring system performance. Collaborates with IT leaders to track anomalies, investigate threats, and address vulnerabilities based on prioritized response plans. Conducts audits, resolves security gaps, and manages contracts for security software and equipment and presents recommendations.

• Oversees threat and vulnerability assessments, conducts routine network and system evaluations for abnormal behavior, and prioritizes response plans. Manages penetration testing and investigates unsecured data or systems, ensuring compliance with policies and governance. Restricts access and blocks threats in high-risk areas, working with relevant parties for swift resolution.

• Recommends professional development for IT security staff and department data officers, coordinating training and awareness programs. Partners with the Public Information Office to guide the public on cyber hygiene and awareness. Addresses threats from bad actors misrepresenting City identities.
   

• Provides supervision through clear direction, sets performance expectations, and guides the team's efforts toward achieving goals. Conducts performance reviews, offers constructive feedback, and supports employee development. Participates in the hiring process by interviewing candidates and making recommendations for new hires.
   

• Performs all other duties and tasks as assigned.

Working Conditions

Mostly office environment.

* All duties, responsibilities listed are subject to change.

MINIMUM REQUIRED QUALIFICATIONS:

Education:

Bachelor's degree

Work Experience:

Five (5) years of directly related experience

License:

Any combination of relevant education and experience may be substituted on a year-for-year basis.

ADDITIONAL MINIMUM REQUIRED QUALIFICATIONS:

Education:

Bachelor's degree

Work Experience:

-Five (5) years of directly related experience

License/C