Assistant Vice Provost & Chief Information Security Officer

Job Description

Department:
Univ Info & Tech Admin (JIS)
Special Instructions to Applicants:
To ensure full consideration, applications must be received by August 10, 2026.
Applications will continue to be accepted after the full consideration date, until a sufficient applicant pool has been achieved or the position is filled. The closing date is subject to change without notice to applicants.

When applying you will be required to attach the following electronic documents:

1) A resume/CV; and

2) A cover letter indicating how your qualifications and experience have prepared you for this position.

Starting salary will be commensurate with skills, education, and experience.
For additional information please contact: Jared Haddock at jared.haddock@oregonstate.edu
The leadership profile for this position can be viewed here:
OSU-CISO-Leadership-Profile.pdf | Powered by Box
An offer of employment does not guarantee Oregon State University's ability or commitment to sponsor employment authorization within the U.S.
Job Summary:
University Information and Technology is seeking an Assistant Vice Provost & Chief Information Security Officer. This is a full-time (1.00

FTE
),12-month, professional faculty position.
At Oregon State University (OSU), University Information and Technology (UIT) is at the forefront of the university's technological transformation. UIT is dedicated to empowering the entire university community by providing secure access to the right data, tools, and services needed to navigate and shape their unique paths to success. By protecting OSU's technological assets and managing resources efficiently, we enable the university to thrive in an ever-evolving landscape.
Led by the Office of the Chief Information Officer (CIO), UIT manages IT operations for OSU's three campuses, serving students in Oregon's 36 counties and in more than 100 countries. UIT's leadership philosophy centers around a human-centric and fully architected technology landscape, leveraging enterprise solutions for common good services while empowering individual colleges and business units to innovate and invest in their missions and initiatives.
UIT designs and implements a seamless, interconnected digital ecosystem that aligns to the university's strategic goals and maximizes impact. The division is comprised of trusted partners and consultants committed to igniting innovation and fostering a culture of continuous improvement by providing expert guidance and innovative solutions that support the university's teaching, research, outreach and extension mission. Together, we are building a future where technology and education converge to create limitless possibilities.
Reporting to the Vice Provost for University Information & Technology and Chief Information Officer, the Assistant Vice Provost & Chief Information Security Officer (CISO) serves as a senior member of the CIO's Executive Leadership Team and a trusted advisor to university leadership at the highest levels. This position operates with significant institutional visibility, engaging regularly with the Provost's Office, General Counsel, Internal Audit, Risk Management, the Board of Trustees, federal agencies, and external partners. The CISO must be equally effective in the executive meetings and in the field, translating complex cybersecurity risk into clear, actionable guidance for audiences ranging from front-line staff and faculty to university executives and governing boards.
The CISO is a connector and a convener, working across every college, department, research unit, and administrative function at OSU to build shared security culture, co-develop practical solutions, and ensure that cybersecurity is understood as a university-wide responsibility rather than an IT-only function. Internally, the CISO cultivates trusted relationships at all levels of the organization, from individual contributors and department administrators to deans, vice provosts, and executive leadership. Externally, the CISO represents OSU with federal agencies, law enforcement, peer research universities, and national cybersecurity communities, ensuring OSU benefits from the best intelligence, partnerships, and practices available in the field.
In a rapidly evolving threat landscape, increasingly shaped by the proliferation of artificial intelligence, nation-state actors, and the unique vulnerabilities of the research enterprise, the CISO must be a forward-thinking, adaptive leader. The CISO ensures OSU's cybersecurity program keeps pace with AI-driven threats and emerging attack vectors, maintaining digital resilience across a complex and decentralized institution. While this role does not lead a dedicated AI governance function, the CISO plays a critical role in evaluating AI tools and practices deployed across the university, ensuring they align with OSU's security standards and do not introduce unacceptable risk to institutional systems, research data, or community members. The CISO brings together strategy and operations, vision and execution, building a cybersecurity program that is proactive, resilient, and reflective of OSU's values as an open, innovative, and mission-driven institution.
In addition, this position provides leadership and operational oversight for the Office of Information Security (OIS), supporting the development, implementation, and continuous improvement of institutional information security practices, risk management, and compliance efforts.
Please note all OSU IT team members are expected to meet the following commitments:

AI Statement:
OSU IT embraces the transformative potential of artificial intelligence (AI) to drive innovation, enhance efficiency, and create meaningful impact across our teaching, research, and administrative functions. As a member of the OSU IT community, the person in this position is expected to thoughtfully engage with AI tools and practices, champion their ethical and responsible use, and actively contribute to the development of AI-driven solutions that uphold our institutional values and advance the university's mission.
Data Statement:
OSU IT commits to deliver data as a strategic working asset and to enable data informed decision making across OSU. OSU IT leaders and staff lead by example and use data to inform decision making at all levels in the organization. Persons in technology roles are also expected to design systems with data portability in mind and work within enterprise architecture and privacy guidelines.

DEIA Statement:
OSU IT commits to and believes in the strength and value of diversity, equity, inclusion, and access (DEIA) both throughout our team and as an intentional and active practice to advance the vision, mission, and strategic efforts of the entire university. As a member of the OSU IT community, the person in this position is expected to foster and promote the values of DEIA and demonstrate a commitment to inclusive excellence in their work.

Security Statement:
Proactively securing and protecting OSU's digital assets and information systems is crucial to our missions of teaching and learning, research, and extension and engagement. All OSU IT professionals are directly responsible for providing high quality and secure IT systems and services. Persons in technology roles are expected to be responsive to security related actions and requirements, and to collaborate to find secure ways to support the OSU community.
Key Responsibilities:
Enterprise Cybersecurity Strategy & AI Security Leadership: Provide executive-level leadership for OSU's enterprise-wide information security program; develop a multi-year strategy grounded in the NIST Cybersecurity Framework and RMF; lead security governance for the responsible adoption of AI and emerging technologies; and serve as the university's foremost authority on cyber risks.
Security Operations, Threat Intelligence & Incident Response: Direct the Security Operations Center and 24/7 threat detection; serve as OSU's IT Incident Manager for critical incidents; lead threat intelligence on AI-enabled and nation-state threats targeting higher education; and oversee vulnerability and third-party risk management.
Policy, Compliance, Risk Governance: Lead enterprise cybersecurity policy and a comprehensive Governance, Risk & Compliance program; ensure compliance with FERPA, HIPAA, GLBA, PCI DSS, NIST 800-53/171, and federal research security mandates; and establish OSU's framework for the secure adoption of AI.
Security Awareness, Education & Community Engagement: Champion a university-wide culture of cybersecurity awareness; design education programs for students, faculty, staff, and researchers; address AI-related security risks; and partner with academic units on curricula, experiential learning, and student engagement.
External Partnerships & Professional Leadership: Build partnerships with federal agencies (CISA, NSF, NIH, DOD), law enforcement, and peer R1 institutions; represent OSU on state and national cybersecurity advisory bodies; and engage with EDUCAUSE, REN-ISAC, and research consortia.
Qualifications:
Required
Qualifications:

A bachelor's degree in Information Security, Computer Science, Information Technology, Business Administration, or a related field.
Minimum of 10 years of progressively responsible leadership experience in information security, cybersecurity, or a closely related field.
Demonstrated knowledge of and experience with common information security frameworks, including NIST CSF, NIST RMF, NIST 800-53, ISO/IEC 27001, or COBIT.
Proven experience developing and executing enterprise-wide cybersecurity strategies that balance institutional risk tolerance with operational flexibility and mission-driven innovation.
Demonstrated experience with security operations, threat intelligence, vulnerability management, and incident response in complex, multi-system environments.
Extensive knowledge of applicable regulatory and compliance requirements, including FERPA, HIPAA, GLBA