Chief Information Security Officer

Overview

The Chief Information Security Officer (CISO) at Princeton is responsible for developing, expanding and maturing the University information security policy and strategy and draws on domain expertise, a capacity for vision and change management and communication skills to establish a high level of understanding of and attention to information security in a world-class institution of teaching, learning and research. 

 

The CISO works collaboratively with University leadership and departmental technical and administrative staff throughout campus. The CISO develops and leads outreach, communication and education efforts to raise campus-wide awareness of information security risk, requirements and solutions; provides strategic and technical guidance and assistance in the design and implementation of appropriate security processes for campus-wide information systems; directs the University IT Risk Assessment process; recommends and monitors computing practices to prevent and recover from security breaches and handles breaches when they occur; provides vision, leadership and development of robust security operations and vulnerability management; and leads the operations and success of access security requirements. 

 

The CISO reports to the Vice President for Information Technology and Chief Information Officer and collaborates with OIT senior staff and key campus business and IT leaders to shape security and business-continuity standards and action plans. The CISO also plays a leadership role in the implementation of security practices and policies through collaboration with technical staff. The CISO has dotted line responsibilities to the VP and Dean for Research, and is designated as the University Research Security Officer for federal grants and projects.  

Responsibilities

Strategic Planning and Policy Development –

• Provides guidance and counsel on information security to the CIO, OIT senior staff and University stakeholders. 

• Works with campus leadership to develop a strategy for information security that balances Princeton's academic values with institutional attention to the risks and requirements generated by the University's increasingly information-rich environment and external regulations. 

• Recommends strategies and practices to ensure information security and leads the design, development and implementation of the University's security and data-governance policies and procedures in consultation with University leadership, OIT and campus technical staff and IT advisory bodies. 

• Represents the University in assessing and approving research security needs and establishes and maintains a strong partnership with Research Protections and Administration, and the Research Integrity Office. 

• Advises University leaders on emerging information security risks and opportunities created by Princeton's role as a world-class institution of teaching, learning and research with increasing global relationships and activities. 

• Tracks industry and higher-ed information security best practices to keep abreast of current techniques, systems and applications. 

• Assumes responsibility for information-security policies and effective IT risk management and compliance across the University; coordinates campus-wide data governance and security initiatives. 

• As a member of the CIO leadership team, contributes to the overall development of OIT's strategic goals, performance metrics, communication practices and culture. 

 

Management –  

• Leads the overall management and success of a robust, current and expanding information security office. 

• Leads an annual IT Risk Assessment process and maintains the efficacy of an IT Business Continuity Plan. 

• Maintains a close relationship with the offices of General Counsel, Audit and Compliance and Public Safety; serves as liaison between these groups and IT professionals for matters pertaining to campus IT security. 

• Assesses hardware/software/services being considered for purchase or implementation for security strengths/risks and information security features; provides security requirements for software/services RFPs. 

 

Training and Outreach –  

• Develops and leads education and training programs on institutional policy, guidelines, federal and state laws and regulations and best practices around information security. 

 

Qualifications

Essential Qualifications:   

• At least 10 years of current experience directly related to the responsibilities of the role  

• Demonstrated domain expertise 

• A strategic gras