Located in Middletown, Connecticut, Wesleyan University is one of the nation’s premier liberal arts colleges with 3,000 undergraduates and 200 graduates. Established in 1831, Wesleyan is known for its rich, open, and interdisciplinary curriculum. Wesleyan University takes the security and privacy of information and resources seriously. 

Wesleyan University's Information Security program safeguards the confidentiality, integrity, and availability of the institution’s information resources. The program provides tools and guidance to help the campus community minimize risks while maintaining productivity, and establishes policies to ensure compliance with regulations, proper usage, and security best practices. 

Reporting to the VP for Information Technology & CIO, the Chief Information Security Officer (CISO) is responsible for maintaining and enhancing an information security management program that meets compliance and regulatory requirements and aligns with the risk posture at Wesleyan. The CISO works with executive management (e.g. the CIO, Legal Counsel, Cabinet, and the Board of Trustees) to determine acceptable levels of risk for the institution and will collaborate with functional areas to implement practices that meet defined policies and standards for information security. As the leader of the security program, the CISO coordinates disparate drivers, constraints, and personalities, while maintaining objectivity and a strong understanding that security is just one of the university’s activities. 

Responsibilities include: 

• Developing, implementing, and monitoring a strategic, comprehensive enterprise information security and IT risk management program. 

• Supervising staff within the areas of information security and Identity and Access Management. 

• Working directly with the functional areas to facilitate IT risk assessment and risk management processes and working with stakeholders throughout the university to align security controls with business processes.  

• Providing regular reporting on the status of the information security program to enterprise risk teams and senior leaders as part of a strategic enterprise risk management program. 

• Creating a framework for roles and responsibilities regarding information ownership, classification, accountability, and protection. 

• Developing, maintaining, and publishing information security policies, standards, and guidelines. Overseeing approval, training, and dissemination of security policies and practices. 

• Ensuring that security policies and programs are in compliance with relevant laws, regulations, and policies to minimize or eliminate risk and audit findings. 

• Creating and managing information security and risk management awareness training programs for all employees, contractors, and approved system users. 

• Facilitating a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the security program. 

• Managing security incidents and events to protect corporate information assets, including intellectual property, regulated data, and the university’s reputation. 

• Liaising with external agencies such as law enforcement and other advisory bodies as needed to ensure that the organization maintains a strong security posture. 

• Serve as liaison between the university and both internal and external auditors. 

• Serve as the university's Data Protection Officer. 

• Other duties as assigned.

This position is a hybrid position with on-campus and remote work schedules.