Chief Information Security Officer

Located in Middletown Connecticut Wesleyan University is one of the nations premier liberal arts colleges with 3000 undergraduates and 200 graduates. Established in 1831 Wesleyan is known for its rich open and interdisciplinary curriculum. Wesleyan University takes the security and privacy of information and resources seriously.

Wesleyan Universitys Information Security program safeguards the confidentiality integrity and availability of the institutions information resources. The program provides tools and guidance to help the campus community minimize risks while maintaining productivity and establishes policies to ensure compliance with regulations proper usage and security best practices.

Reporting to the VP for Information Technology & CIO the Chief Information Security Officer (CISO) is responsible for maintaining and enhancing an information security management program that meets compliance and regulatory requirements and aligns with the risk posture at Wesleyan.The CISO works with executive management (e.g. the CIO Legal Counsel Cabinet and the Board of Trustees) to determine acceptable levels of risk for the institution and will collaborate with functional areas to implement practices that meet defined policies and standards for information security.As the leader of the security program the CISO coordinates disparate drivers constraints and personalities while maintaining objectivity and a strong understanding that security is just one of the universitys activities.

Responsibilities include:

• Developing implementing and monitoring a strategic comprehensive enterprise information security and IT risk management program.

• Supervising staff within the areas of information security and Identity and Access Management.

• Working directly with the functional areas to facilitate IT risk assessment and risk management processes and working with stakeholders throughout the university to align security controls with business processes.

• Providing regular reporting on the status of the information security program to enterprise risk teams and senior leaders as part of a strategic enterprise risk management program.

• Creating a framework for roles and responsibilities regarding information ownership classification accountability and protection.

• Developing maintaining and publishing information security policies standards and guidelines. Overseeing approval training and dissemination of security policies and practices.

• Ensuring that security policies and programs are in compliance with relevant laws regulations and policies to minimize or eliminate risk and audit findings.

• Creating and managing information security and risk management awareness training programs for all employees contractors and approved system users.

• Facilitating a metrics and reporting framework to measure the efficiency and effectiveness of the program facilitate appropriate resource allocation and increase the maturity of the security program.

• Managing security incidents and events to protect corporate information assets including intellectual property regulated data and the universitys reputation.

• Liaising with external agencies such as law enforcement and other advisory bodies as needed to ensure that the organization maintains a strong security posture.

• Serve as liaison between the university and both internal and external auditors.

• Serve as the universitys Data Protection Officer.

• Other duties as assigned.