Chief Information Security Officer

Standard Header - 17May24

Chief Information Security Officer (CISO): Under limited direction, manages the South Carolina Department of Revenue's information security program to prevent, detect, respond to and recover from unauthorized exposure of information assets. Develops, sustains and enforces the agency's information security strategy, policies and standards. Coordinates responses to threats to information assets. Manages compliance with requirements of federal, state and industry authorities. Informs senior management of information security risk status and engages them in security decisions. Oversees the agency's business continuity and disaster recovery program.

Governance, Risk and Compliance: Manages the agency's information security policies, standards, enterprise security plan, risk management,  metrics, reports and enforcement. Responsibility for compliance with external authorities, including: IRS, CJIS, PCI DSS, legislative and executive orders and the SC Division of Information Security. Responsibility for reviews, audits, assessments, findings, remediation and exceptions/variances.

Security Engineering and Operations: Manages all aspects of information security architecture, including planning, design, review and enforcement. Maintains accountability for the agency's Network and Security Operations Center (NSOC) to include monitoring for cyber intrusions, compliance with security policies, security device integrity and IT system health. Responsibility for detecting and responding to threatening events, including security events and IT operational events.

Security Leadership by Influence: Establishes direction and influences aspects of information security that are not performed under direct control of the CISO Division, including IT systems (CIO), employee awareness (Training), data privacy (Legal), vendor contracts (Procurement) and joint responsibilities with the SC Division of Information Security. 

Vendor and Partner Security: Establishes direction for information security aspects of vendor and partner relationships, including contracts, memorandums of understanding and statements of work. Responsible for information security oversight of vendors and partners, including requirements, evaluations, assessments and audits. 

Business Continuity: Oversees business continuity, disaster recovery and cyber security incident response processes to ensure that the agency is capable of responding to events that disrupt business or technical operations.

Staff Development: Develops information security staff skills and abilities. Develops information security staffing strategies, plans and practices to maintain a cyber security workforce. 

A bachelors degree in engineering, computer science, information technology or a related field with a minimum of eight years of experience in information technology administration, project management or a related field. Four of the eight years must be in information security, information risk management, security compliance or information technology auditing. One of the following certifications is also required: CISSP, CISM, CRISC, CCISO.

Relevant experience may be substituted for bachelor's degree on a year-for-year basis.

Academic degrees must be from an accredited institution of higher learning.
 

Must provide leadership to interpret industry standards and governmental regulations.  Work in federal or state government or the financial industry is highly desirable.  Must possess a depth of knowledge and experience to make technical and administrative decisions with incomplete and subjective information and to respond to critical situations tha require immediate action.  Must work independently and be self-directed to set and meet objectives.  

KSA's: Broad managerial skills.  Ability to apply information security principles from an executive management point of view.  Ability to communicate security topics to all levels of audiences.  Expert security knowledge in the following areas: risk management, technical architecture, policies and controls, enterprise security plans, security assessments and audits, security governance, metrics and reporting, compliance with PCI DSS and NIST SP 800-53, vendor security management, SOC operations, incident response, employee security awareness, data privacy, and business continuity.  

SCDOR employees are required to be in compliance with all SCDOR tax requirements and are subject to a National Criminal Background Check to include fingerprinting. 

During critical events, 24x7 support will be required.  

Standard Footer- 17May24