VP Enterprise Security Office, CISO and CPO

Auditing / IT / Internal / External Harrisburg, PA • ID: 632-369 • Full-Time/Regular PHEAA is a nonprofit student aid organization that holds a mission of providing affordable access to higher education. Give back tomorrow by joining us today! Salary: Grade 20, Commensurate with experience starting at $153,222.00 Shift: Monday through Friday 8:00 AM - 5:00 PM - Hybrid 2 days a week onsite Location: PHEAA Headquarters 1200 North 7th Street, Harrisburg, PA 17102 Department: Enterprise Security Office JOB PURPOSE AND SUMMARY This role is responsible for planning, developing, and operating reliable information security and privacy programs that support the integrity and availability of digital information, safeguards the Agency’s digital assets, and implements effective and appropriately scaled security and privacy policies, practices, and technologies. Develop relationships with all levels of the organization to implement appropriate security and privacy standards and procedures. This position is responsible for monitoring compliance with the legislated requirements that impact information security and privacy for PHEAA in its roles as an independent state agency and a commercial enterprise. PRIMARY DUTIES AND RESPONSIBILITIES Security Leadership Build an enterprise-wide cybersecurity culture that improves security awareness and instills a risk-aware culture in the Agency. Develop, manage and set the vision, goals, and priorities for information security at PHEAA. Advise and report to Agency executive leadership and Board as may be required or requested on current Agency cybersecurity strategy and cybersecurity risk. Lead initiatives related to Information Security strategic planning. Provide strategic oversight for the security execution of enterprise projects, initiatives, and organizational changes, ensuring effective leadership and alignment across security managers, team leads, and staff. Drive and oversee execution of security projects and initiatives, empowering security managers, team leads, and staff. Set and manage the budget for the Enterprise Security Office. Consult with business and Information Technology stake holders to understand their business and technical plans and formulate an Information Security plan that allows the Agency to achieve its goals. Define Information Security metrics and report them regularly as required by Agency processes. Stay current on emerging technology, trends, legislation, and threats that impact the Agency’s information security posture. Information Security and Privacy Management Lead the development and maintenance of the Agency’s strategic cyber-security roadmap. Oversee the development, implementation, and management of security strategy processes, along with related architecture and engineering standards. Assist in the review of applications and technology environments during the development and acquisitions process. Translate and interpret technical risks for a broad range of audiences including the Board and Executive Leadership. Maintain current knowledge of applicable cyber-security and privacy laws and monitor advancements in information security and privacy to ensure Agency adaptation and compliance. Define and drive compliance with the Agency’s enterprise security and privacy policies and standards, and ensure the related controls are in place and operating effectively. Security Risk Management Lead the development and implementation of the information security policy, standards, guidelines, and procedures that balance business objectives with information security risk. Identify protection goals, objectives, and metrics consistent with Agency goals and regulatory requirements. Collaborate with stakeholders to gain alignment on the determination on acceptable levels of risk. Prioritize security initiatives and spending aligned with overall Agency risk management and financial goals. Identify requirements and oversee development of Agency cyber-security training. Staff Mana…