Job Title: Senior Advisor to the Chief Information Security Officer (CISO)
Department: NYC Department of Health and Mental Hygiene (DOHMH) Division: Information Technology
Bureau: DIT Administration
- Location: 42-09 28th street LIC (In-person).
- Duration: 1 Year.
- Hours per Week: 40.
- Interview Process: in-office, possibly two rounds.
- Please include candidate rates in your submission
Summary of Position:
The Senior Advisor to the CISO supports the agency's mission by providing expert strategic, technical, and programmatic counsel to the Chief Information Security Officer. Through collaboration, sound risk management, and a practical understanding of operational needs, the Senior Advisor helps the CISO advance a modern cybersecurity program that balances security, operational resilience, governance, regulatory compliance, and business enablement, while protecting the agency's information assets and technology infrastructure.
The Senior Advisor to the CISO serves as a trusted advisor and key strategic partner to the Chief Information Security Officer. The Senior Advisor provides expert guidance on cybersecurity strategy, risk, governance, and incident readiness; leads high-priority initiatives and special projects on behalf of the CISO; and helps ensure the Office of Cybersecurity's priorities are carried out effectively and consistently.
The Senior Advisor works across the Cybersecurity Response, Cybersecurity Risk, and Cybersecurity Governance teams, and collaborates with Information Technology, business units, executive leadership, and external partners to align cybersecurity efforts with the agency's mission.
Job Duties:
Strategic Advisory
- Advise the CISO on cybersecurity strategy, program priorities, and the multi-year cybersecurity roadmap.
- Provide analysis and recommendations on cybersecurity risks, emerging threats, and mitigation strategies.
- Prepare briefings, decision memos, and presentations for the CISO and executive leadership.
- Track progress on the CISO's strategic priorities and identify issues requiring attention or escalation.
- Represent the CISO in meetings, working groups, audits, and engagements with regulatory agencies and external partners, as designated.
- Promote collaboration between cybersecurity, Information Technology, and business units to integrate security throughout the technology lifecycle.
Cybersecurity Response Support
- Advise the CISO on the effectiveness of the agency's cybersecurity response capabilities, including:
- Cybersecurity incident response and recovery.
- Security monitoring, threat detection, and analysis.
- Vulnerability management and remediation.
- Cyber incident preparedness, tabletop exercises, and operational readiness.
- Security automation and continuous operational improvement.
- Support the CISO during major incidents by coordinating information, tracking actions, and preparing executive communications.
Cybersecurity Risk Support
- Provide expert guidance to the CISO and the Cybersecurity Risk Team on:
- Enterprise cybersecurity risk assessments.
- Security reviews of applications, cloud services, infrastructure, and emerging technologies.
- Third-party and vendor security risk.
- Risk exception decisions and security architecture considerations.
- Enterprise cyber risk reporting and recommendations.
Cybersecurity Governance Support
- Advise the CISO on the agency's cybersecurity governance framework to support effective risk management, regulatory compliance, and strategic decision-making, including:
- Development and review of cybersecurity policies, standards, and procedures.
- Regulatory and compliance activities, including HIPAA, PCI DSS, NIST, and other applicable requirements.
- Internal and external audits and related corrective action plans.
- The agency's cybersecurity Risk Register and Plans of Action & Milestones (POA&M).
- Executive dashboards, cybersecurity metrics, and program performance reporting.
- Evaluating the effectiveness of the cybersecurity program and recommending continuous improvements.
Special Projects and Initiatives
- Lead high-priority, cross-functional cybersecurity initiatives and special projects as assigned by the CISO.
- Provide program management and coordination for strategic cybersecurity efforts.
- Research and evaluate emerging technologies, threats, and industry best practices, and recommend actions.
- Support budget planning, contract review, and vendor evaluations as requested by the CISO.
Strategic Responsibilities
- Contribute to the development and implementation of multi-year cybersecurity strategies and roadmaps.
- Support efforts to advance the maturity of the agency's cybersecurity governance program.
- Help strengthen enterprise cyber resilience and incident readiness.
- Promote security-by-design principles across technology initiatives.
- Help measure and communicate cybersecurity program performance using meaningful operational and risk metrics.
- Support organizational objectives by balancing security, operational efficiency, compliance, and business enablement.
Qualifications and Requirements:
- Bachelor's degree from an accredited college or university in Information Security, Computer Science, Information Technology, Business Administration, Public Administration, or a related field.
- Ten (10) years of progressively responsible experience in information technology or cybersecurity, including experience in cybersecurity operations, risk management, governance, incident response, and security program management.
- Five (5) years of experience in senior advisory, leadership, or program management role supporting cybersecurity or information technology programs.
Preferred Qualifications
- Master's degree in Cybersecurity, Information Technology, Business Administration, Public Administration, or a related field.
- Professional certifications such as CISSP, CISM, CRISC, CGEIT, or GIAC certifications.
- Experience within government, healthcare, or other highly regulated environments.
- Demonstrated experience implementing and managing cybersecurity frameworks such as the NIST Cybersecurity Framework, NIST SP 800-53, HIPAA Security Rule, PCI DSS, and CIS Critical Security Controls.
Knowledge, Skills & Abilities
- Strategic thinking and sound judgment as a trusted executive advisor.
- Strategic planning and cybersecurity program development.
- Enterprise cybersecurity governance and risk management.