Corporate Information Security Chief (14824, Grade 36)

The Corporate Chief Information Security Officer (CISO) is the Commission's senior executive responsible for strategic leadership, governance, and management of the enterprise cybersecurity program. Reporting directly to the Chief Information Officer, the CISO protects information assets, technology infrastructure, critical business systems, public services, and public trust while enabling the Commission's mission and organizational objectives.

The CISO directs cybersecurity operations for the bi-county corporate offices and establishes Commission-wide security policies, outcome-based standards, and risk expectations that recognize the operational independence of the four operating departments. The position provides clear, candid advice to executive leadership and governing bodies; coordinates across technology, legal, audit, procurement, business, and departmental stakeholders; and leads the Commission's response to material cyber risks and incidents.

Examples of Duties Security Strategy, Governance, and Executive Leadership Develop, implement, and maintain a multi-year, risk-based enterprise cybersecurity strategy and roadmap aligned with organizational goals, business objectives, and risk tolerance. Establish and oversee cybersecurity governance frameworks, policies, standards, procedures, and performance measures, including alignment with the NIST Cybersecurity Framework 2.0 and CIS Critical Security Controls.

Advise the CIO, Executive Committee, Audit Committee, Commissioners, departmental CTOs, and other leadership bodies on security posture, significant risks, emerging threats, remediation priorities, and investment decisions. Develop executive dashboards, metrics, and reports that translate technical risk into clear business, operational, financial, and public-service impacts. Chair the Commission's Cybersecurity group, set its agenda and priorities, and maintain a shared view of cross-group decisions, dependencies, and open risks.

Participate in the CIO-chaired Technology Committee and serve as a standing member of the AI Advisory Committee and Microsoft Infrastructure group, connecting security and privacy decisions across these governance bodies. Balance Commission-wide security standards with departmental operational independence across both counties. Enterprise Risk, Compliance, and Audit Management Lead the identification, assessment, quantification, prioritization, treatment, and monitoring of enterprise cybersecurity risks.

Maintain the enterprise cybersecurity risk register, risk treatment plans, accepted-risk records, and remediation tracking. Assess risks associated with cloud services, artificial intelligence, emerging technologies, enterprise applications, operational technology, connected building systems, vendors, and third-party service providers. Ensure compliance with applicable federal, Maryland, and county requirements; contractual obligations; PCI DSS; public-information requirements; and adopted security frameworks.

Coordinate cybersecurity audits, regulatory reviews, independent assessments, and cyber insurance activities, and work with the Office of the Inspector General and external auditors. Own and coordinate timely remediation of audit findings, control deficiencies, and compliance gaps. Security Operations, Incident Response, and Resilience Direct cybersecurity monitoring, threat detection, cyber defense, and response activities for the bi-county corporate offices, and establish Commission-wide detection and response standards.

Lead cybersecurity incident investigation, containment, eradication, recovery, communications, reporting, and lessons-learned activities in coordination with affected departments. Maintain and regularly exercise Commission-wide incident response policies, plans, procedures, escalation protocols, and executive communication processes. Serve as cybersecurity liaison to relevant state and federal partners, including CISA, MS-ISAC, and Maryland emergency management entities.

Oversee vulnerability and exposure management, endpoint protection, security monitoring, independent testing, and remediation verification. Partner with IT and departments to establish and test business continuity, disaster recovery, and cyber-recovery expectations for critical public services. Identity, Cloud, Architecture, and Technology Security Establish commission-wide expectations for identity governance, access management, privileged access, least privilege, segregation of duties, access certification, and cloud security.

Guide security architecture and access governance for enterprise platforms and applications, including Workday and Microsoft 365. Review and approve security access models and security requirements for major systems, business processes, architectural designs, technology implementations, acquisitions, contracts, and vendor engagements. Establish security architecture principles for applications, infrastructure, networks, cloud platforms, data, operational technology, and connected environments.

Integrate security into project management, software development, procurement, and change management practices, promoting secure-by-design and zero-trust principles. Coordinate with the Microsoft Infrastructure group on security settings for Microsoft Copilot and other AI-enabled capabilities. Data Protection, Privacy, Records, and Responsible AI Lead data classification, handling, retention, and protection standards for resident, employee, payment, law enforcement, and other sensitive Commission data.

Partner with the Legal Department on privacy, records retention, e-discovery, public information obligations, and related data governance requirements. Provide the security and privacy perspective for responsible AI adoption by assessing AI tools, use cases, and vendors and establishing guardrails for data use. Bring security and privacy requirements into AI use-case reviews while recognizing the AI Advisory Committee's role in evaluating business value and adoption.

Third-Party, Vendor, and Supply Chain Security Manage a shared vendor security review process, including SARPP and other third-party risk assessments—before procurement and contract renewal. Evaluate the security posture of technology providers, cloud vendors, consultants, and managed service providers. Partner with Purchasing and Legal to establish standard cybersecurity and privacy contract terms and ensure requirements are incorporated into procurement and vendor management processes.

Monitor and manage material third-party and supply-chain risks throughout the vendor lifecycle. Security Awareness, Culture, and Workforce Direct Commission-wide security awareness, education, and phishing simulation programs for a large, distributed, and seasonal workforce. Promote a culture of cybersecurity accountability, sound data stewardship, and risk awareness across the organization. Lead, develop, recruit, coach, and evaluate cybersecurity staff and manage contractors, consultants, and managed security service providers.

Develop the cybersecurity budget, strategic investment plan, and business cases using total cost of ownership, risk reduction, service impact, and organizational priorities. Manage cybersecurity projects and initiatives and foster effective partnerships with CTOs, department leadership, auditors, legal counsel, purchasing, vendors, and external agencies. Qualifications Bachelor’s Degree in Computer Science, Information Systems, Computer Engineering, Software Engineering, GIS Technology or any related field.

Eight (8) years of progressively responsible information technology security experience. An equivalent combination of education and experience may be substituted, which together total twelve (12) years. Information security certification(s) is desired; such as, Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP). Preferred Qualifications Education Bachelor's degree from an accredited college or university in cybersecurity, information technology, computer science, information systems, engineering, or a closely related field.

A master's degree in a related field is preferred. Experience Ten (10) years of progressively responsible information technology and cybersecurity experience. Five (5) years of leadership experience managing enterprise cybersecurity programs, teams, budgets, and service providers. Demonstrated experience developing cybersecurity governance frameworks, policies, standards, risk management programs, and executive reporting.

Substantial experience with incident response, security operations, compliance and audit management, identity governance, cloud security, data protection, third-party risk, and security architecture. Experience supporting the public sector, government, critical public services, or another highly regulated environment is preferred. Preferred Certifications One or more of the following certifications is preferred: CISSP, CISM, CRISC, CGEIT, CCSP, CISA, GIAC, or Certified Ethical Hacker (CEH).

Knowledge, Skills, and Abilities Expert knowledge of cybersecurity governance, enterprise risk management, compliance, security operations, and incident response. Advanced knowledge of the NIST Cybersecurity Framework, CIS Critical Security Controls, zero-trust principles, and related security standards. Strong knowledge of cloud security, identity and access management, data protection, privacy, vulnerability management, security monitoring, operational technology, and third-party risk.

Understanding enterprise applications and platforms supporting ERP, human resources, finance, procurement, payments, GIS, public safety, recreation, collaboration, and public-facing digital services. Ability to convert technical findings and threat information into practical business decisions, investment priorities, and executive-level communications. Excellent judgment, integrity, written and oral communication, presentation, negotiation, and relationship management skills.

Ability to lead through influence in a federated environment, build consensus across departments, and preserve accountability while respecting operational independence. Ability to manage multiple high-priority initiatives and respond effectively to rapidly changing threats and operational conditions. Supplemental Information Classification/Specification: Corporate Information Security Chief May be subject to medical, drug and alcohol testing.

Leadership Relationships and Scope Reports directly to the Chief Information Officer. Briefs the Executive Committee, Audit Committee, Commissioners, Technology Committee, and other governance bodies as assigned. Chairs the Commission's Cybersecurity group and coordinates with the AI Advisory Committee and Microsoft Infrastructure group. Works closely with departmental CTOs and technology teams, executive and business leaders, legal, purchasing, the Office of the Inspector General, auditors, cyber insurance carriers, vendors, and state and federal cybersecurity partners.

Directs assigned cybersecurity staff and oversees contractors, consultants, and managed security service providers. Position Expectations The CISO is expected to exercise independent judgment on significant cybersecurity matters; escalate material risks promptly; maintain confidentiality and professional integrity; and provide objective, risk-based recommendations that support secure, resilient, and effective delivery of Commission services.

The Maryland-National Capital Park and Planning Commission (M-NCPPC) is an Equal Opportunity Employer. We celebrate a workplace culture of diversity, equity and inclusion without discrimination or harassment on the basis of race, color, religion, sex, age, national origin, sexual orientation, marital status, disability, genetic information, gender identity, or any other non-merit factor. Applicants with Disabilities under the Americans with Disabilities Act.

If you require accommodations or special arrangements due to a qualifying disability, please notify the Recruitment & Selections Services Unit at the time of applications at or 301-454-1411 (Maryland Relay 7-1-1) M-NCPPC will make all efforts to reasonably accommodate you.