Assistant Vice Provost & Chief Information Security Officer

Univ Info & Tech Admin (JIS)

To ensure full consideration applications must be received by August 10 2026. Applications will continue to be accepted after the full consideration date until a sufficient applicant pool has been achieved or the position is filled. The closing date is subject to change without notice to applicants.

When applying you will be required to attach the following electronic documents:

1) A resume/CV; and

2) A cover letter indicating how your qualifications and experience have prepared you for this position.

Starting salary will be commensurate with skills education and experience.

For additional information please contact: Jared Haddock at

The leadership profile for this position can be viewed here:

An offer of employment does not guarantee Oregon State Universitys ability or commitment to sponsor employment authorization within the U.S.

University Information and Technology is seeking an Assistant Vice Provost & Chief Information Security Officer. This is a full-time (1.00FTE)12-month professional faculty position.

At Oregon State University (OSU) University Information and Technology (UIT) is at the forefront of the universitys technological transformation. UIT is dedicated to empowering the entire university community by providing secure access to the right data tools and services needed to navigate and shape their unique paths to success. By protecting OSUs technological assets and managing resources efficiently we enable the university to thrive in an ever-evolving landscape.

Led by the Office of the Chief Information Officer (CIO) UIT manages IT operations for OSUs three campuses serving students in Oregons 36 counties and in more than 100 countries. UITs leadership philosophy centers around a human-centric and fully architected technology landscapeleveragingenterprise solutions for common good services while empowering individual colleges and business units to innovate and invest in their missions and initiatives.

UIT designs and implements a seamless interconnected digital ecosystem that aligns to the universitys strategic goals and maximizes impact. The division iscomprisedof trusted partners and consultants committed to igniting innovation and fostering a culture of continuous improvement by providing expert guidance and innovative solutions that support the universitys teaching researchoutreachand extension mission. Together we are building a future where technology and education converge to create limitless possibilities.

Reporting to the Vice Provost for University Information & Technology and Chief Information Officer the Assistant Vice Provost & Chief Information Security Officer (CISO) serves as a senior member of the CIOs Executive Leadership Team and a trusted advisor to university leadership at the highest levels. This position operates with significant institutional visibility engaging regularly with the Provosts Office General Counsel Internal Audit Risk Management the Board of Trustees federal agencies and external partners. The CISO must be equally effective in the executive meetings and in the field translating complex cybersecurity risk into clear actionable guidance for audiences ranging from front-line staff and faculty to university executives and governing boards.

The CISO is a connector and a convener working across every college department research unit and administrative function at OSU to build shared security culture co-develop practical solutions and ensure that cybersecurity is understood as a university-wide responsibility rather than an IT-only function. Internally the CISO cultivates trusted relationships at all levels of the organization from individual contributors and department administrators to deans vice provosts and executive leadership. Externally the CISO represents OSU with federal agencies law enforcement peer research universities and national cybersecurity communities ensuring OSU benefits from the best intelligence partnerships and practices available in the field.

In a rapidly evolving threat landscape increasingly shaped by the proliferation of artificial intelligence nation-state actors and the unique vulnerabilities of the research enterprise the CISO must be a forward-thinking adaptive leader. The CISO ensures OSUs cybersecurity program keeps pace with AI-driven threats and emerging attack vectors maintaining digital resilience across a complex and decentralized institution. While this role does not lead a dedicated AI governance function the CISO plays a critical role in evaluating AI tools and practices deployed across the university ensuring they align with OSUs security standards and do not introduce unacceptable risk to institutional systems research data or community members. The CISO brings together strategy and operations vision and execution building a cybersecurity program that is proactive resilient and reflective of OSUs values as an open innovative and mission-driven institution.

In addition this position provides leadership and operational oversight for the Office of Information Security (OIS) supporting the development implementation and continuous improvement of institutional information security practices risk management and compliance efforts.

Please note allOSU ITteam members are expected to meet the following commitments:

AI Statement:OSU IT embraces the transformative potential of artificial intelligence (AI) to drive innovation enhance efficiency and create meaningful impact acrossourteaching research and administrative functions. As a member of the OSU IT community the person in this position is expected to thoughtfully engage with AI tools and practices champion their ethical and responsible use and actively contribute to the development of AI-driven solutions that uphold our institutional values and advance the universitys mission.

Data Statement:OSU ITcommits todeliverdata as a strategic working asset and to enable data informed decision making across ITleaders and staff lead by example and use data to inform decision making at all levels in the organization. Persons in technology roles are also expected to design systems with data portability in mind and work within enterprise architecture and privacy guidelines.

DEIA Statement:OSU ITcommits to and believes in the strength and value of diversity equity inclusion and access (DEIA) both throughout our team and as an intentional and active practice to advance the vision mission and strategic efforts of the entire university. As a member of theOSU ITcommunity the person in this position is expected to foster and promote the values of DEIA anddemonstratea commitment to inclusive excellence in their work.

Security Statement:Proactively securing and protecting OSUs digital assets and information systems is crucial to our missions of teaching and learning research and extension and engagement. All OSU IT professionals aredirectly responsiblefor providinghigh quality and secure IT systems and services. Persons in technology roles are expected to be responsive to security related actions and requirements and to collaborate to find secure ways to support the OSU community.

Key Responsibilities:

• Enterprise Cybersecurity Strategy & AI Security Leadership: Provide executive-level leadership for OSUs enterprise-wide information security program; develop a multi-year strategy grounded in the NIST Cybersecurity Framework and RMF; lead security governance for the responsible adoption of AI and emerging technologies; and serve as the universitys foremost authority on cyber risks.
• Security Operations Threat Intelligence & Incident Response: Direct the Security Operations Center and 24/7 threat detection; serve as OSUs IT Incident Manager for critical incidents; lead threat intelligence on AI-enabled and nation-state threats targeting higher education; and oversee vulnerability and third-party risk management.
• Policy Compliance Risk Governance: Lead enterprise cybersecurity policy and a comprehensive Governance Risk & Compliance program; ensure compliance with FERPA HIPAA GLBA PCI DSS NIST 800-53/171 and federal research security mandates; and establish OSUs framework for the secure adoption of AI.
• Security Awareness Education & Community Engagement: Champion a university-wide culture of cybersecurity awareness; design education programs for students faculty staff and researchers; address AI-related security risks; and partner with academic units on curricula experiential learning and student engagement.
• External Partnerships & Professional Leadership: Build partnerships with federal agencies (CISA NSF NIH DOD) law enforcement and peer R1 institutions; represent OSU on state and national cybersecurity advisory bodies; and engage with EDUCAUSE REN-ISAC and research consortia.

Required Qualifications:

• A bachelors degree in Information Security Computer Science Information Technology Business Administration or a related field.

• Minimum of 10 years of progressively responsible leadership experience in information security cybersecurity or a closely related field.

• Demonstrated knowledge of and experience with common information security frameworks including NIST CSF NIST RMF NIST 800-53 ISO/IEC 27001 or COBIT.

• Proven experience developing and executing enterprise-wide cybersecurity strategies that balance institutional risk tolerance with operational flexibility and mission-driven innovation.

• Demonstrated experience with security operations threat intelligence vulnerability management and incident response in complex multi-system environments.

• Extensive knowledge of applicable regulatory and compliance requirements including FERPA HIPAA GLBA PCI DSS NIST 800-171 and federal research security mandates.

• Demonstrated experience with cloud computing security (IaaS PaaS SaaS) and securing hybrid and multi-cloud technology environments.

• Highly effective written and verbal communication skills with a proven ability to translate complex cybersecurity and AI risk concepts for technical and non-technical audiences at all levels including boards executives faculty and students.

• Demonstrated ability to build trusted collaborative relationships across diverse institutional stakeholders

• Strong financial acumen with experience in budget management resource planning and aligning security investments with strategic institutional priorities.

• Proven commitment to promoting and enhancing inclusive excellence in the workplace.

This position is designated as a critical or security-sensitive position; therefore the incumbent must successfully complete a criminal history check and be determined to be position qualified as per University Standard: 05-010 et seq. Incumbents are required to self-report convictions and those in youth programs may have additional criminal history checks every 24 months.

The Criminal History Check will include fingerprinting and successful completion of the Criminal Justice Information Systems (CJIS) online training.

This position requires driving a university vehicle or a personal vehicle on behalf of the university; therefore the incumbent must successfully complete a motor vehicle history check possess and maintain a current valid drivers license in their state of residence be determined to be position qualified and self-report convictions as per University Policy 05-030.

Final candidates for this position must complete a sexual misconduct reference check per University Policy 05-010. An offer of employment will be contingent upon satisfactory results from the sexual misconduct reference check.

Preferred Qualifications:

• A masters degree in Information Security Computer Science Information Technology Business Administration or a related field.

• Minimum of 5 years in a senior cybersecurity leadership role with demonstrated experience managing and developing high-performing security teams in complex matrixed organizational environments.

• Active professional certification: CISSP CCISO CISM CISA or equivalent advanced credential.

• Demonstrated knowledge of or experience with AI security risks AI governance frameworks (e.g. NIST AI RMF) and the security implications of AI/ML technologies including generative AI tools and platforms.

• Experience in higher education information security with demonstrated understanding of the unique regulatory research and governance environment of a research-intensive (R1) land-grant university.

• Experience with federal research security requirements including NSPM-33 CUI handling and export control compliance.

• Demonstrated experience developing and implementing AI governance or AI security programs including policies and risk frameworks for generative AI and machine learning platforms.

• Familiarity with identity and access management (IAM) strategies for large diverse and decentralized user populations.

• Experience with SOC management including 24/7 monitoring threat intelligence platforms and SIEM technologies.

• Experience leading organizational change initiatives and transforming security culture in complex decentralized environments.

• Familiarity with EDUCAUSE HEISC and REN-ISAC threat intelligence communities.

• Experience with privacy program management and collaboration with institutional Privacy Officers.

Schedule
This position will work a typical Monday Friday schedule and will be based on the Corvallis campus.

This position may at times require work outside of normal business hours and/or weekends.

Inclement Weather
This position is deemed essential and the incumbent may be expected to report to work during inclement weather emergencies and other University work curtailments or closures.

Modality
Hybrid: This position is designated as hybrid working both on-site and remotely. The exact amount of on-site and remote work and schedule will be discussed with the supervisor. Hybrid work is dependent on business needs.

Travel
This position may require occasional duties/business trips to other OSU locations away from the OSU Corvallis campus.

$202375 - $240000

We are an Equal Opportunity Employer including disability protected veteran and other protected status.

OSU will conduct a review of the National Sex Offender Public website prior to hire.

OSU is a fair chance employer committed to inclusive hiring. We encourage applications from candidates who bring a wide range of lived experience including involvement with the justice system. If this position has critical or security-sensitive responsibilities and/or driving duties and you are selected as a finalist your initial job offer will be contingent upon the results of a job-related pre-employment check (such as a background check motor vehicle history check sexual misconduct reference check etc.). Background check results do not automatically disqualify a candidate. Take a look at our Background Checks website including the for candidates section for more details. If you have questions or concerns about the pre-employment check please contact OSUs Employee and Labor Relations team at .