Director, Information Security

Chicago Public Schools (CPS) is one of the largest school districts in the United States, serving over 320,000 students in 600+ schools and employing approximately 40,000 people, most of them teachers. CPS has set ambitious goals to ensure that every student, in every school and every neighborhood, has access to a world-class learning experience that prepares each for success in college, career, and civic life. In order to fulfill this mission, we make three commitments to our students, their families, and all Chicagoans: academic progress, financial stability, and integrity. Six core values are embedded within these commitments - student-centered, whole child, equity, academic excellence, community partnership, and continuous learning.
The Office of Information and Technology Services (ITS) works to build the capacity of schools to use information and technology, maintain network infrastructure, and security standards, and support other departments to meet district goals. ITS provides innovative technology solutions that improve the quality of education for students, reduce the administrative burden on educators, facilitate parent interaction, increase community engagement, and support CPS' mission of transparency by focusing on the ease and equity of access to information.
Job Summary:
Reporting to the Executive Director, Information Security, the Director, Information Security will lead the Information Security team responsible for maturing the Information Security program. This role will work closely with the Executive Director, Information Security to shape and deliver Information Security initiatives to increase the district's Information Security posture. The Director, Information Security will play an integral part in developing policies and procedures that foster CPS's mission while reducing risk and providing the technical insight required to manage the cybersecurity-related infrastructure.
The Director, Information Security will be held accountable for the following responsibilities:

• Conduct Information Security risk assessments and develop solutions to mitigate those risks
• Recruit, onboard, and provide direction, guidance, and strong leadership and performance management to the Information Security teams to ensure robust learning and career development consistent with the CPS values and mission; foster collaboration and effective integration of efforts with division-wide initiatives
• Act as an active contributor to the design and implementation of security architecture solutions, including but not limited to network security, cloud security, identity and access management, and data security
• Provide strategic risk guidance for IT projects, including evaluation and recommendation of technical controls
• Act as subject matter expert for Information Security on projects and interactions with CPS administrative units such as Internal Audit, Law, Finance, Safety & Security, Risk Management, Talent, and Information Technology Services teams
• Collaborate with stakeholders to ensure that pragmatic guidance is given to complex areas of security and privacy, protecting students, staff, and the district
• Provide guidance in vetting parties that CPS has a relationship with from an Information Security perspective
• Assist and manage forensic investigations per situational requirements
• Perform security incident and event management and leadership
• Monitor the external environment for new technologies and solutions
• Help define the key indicators that tell the story of Information Security and define a path forward
• Work with system administrators and application developers to audit, monitor, and validate their security, including conducting gap analysis
• Other duties as assigned

In order to be successful and achieve the above responsibilities, the Director, Information Security must possess the following qualifications:
Education Required:

• Bachelor's degree in Computer Science, Information Systems, or related discipline from an accredited college or university
• Master's degree in Computer Science, Information Systems, or discipline from an accredited college or university, preferred
• Professional Certification in Information Security or Privacy, preferred

Experience Required:

• Minimum of seven (7) years of experience in information technology, or relevant field, including the following, is required:
• Minimum of three (3) years of Information Security related work experience
• Minimum of three (3) years of experience in a supervisory/management position responsible for leading teams of direct reports in the ITS or technology field
• Experience in diverse IT environments supporting a large user base, preferred
• Experience with robust Information Security programs, policies, and procedures in large enterprise environments, preferred

Knowledge, Skills, and Abilities:

• Deep understanding of the Information Security domains
• Inquisitive, curious, and driven to solve problems in the new Information Security paradigm
• A high degree of self-sufficiency with the ability to work independently towards competing deadlines in a rapidly evolving environment
• Familiarity with existing and emerging technologies and strategies surrounding Information Security
• Knowledge of SIEM reporting as well as how to best utilize this data
• Collaborative team member capable of working with and understanding the needs of a wide range of stakeholders from other departments, driving to a common solution
• Strong knowledge of common Information Security management frameworks, such as ISO/IEC 27001, COBIT, NIST, or CSA
• Deep knowledge and understanding of relevant legal and regulatory requirements/standards, including but not limited to: Family Educational Rights and Privacy Act (FERPA), Health Insurance Portability and Accountability Act of 1996 (HIPAA), Children's Online Privacy Protection Act (COPPA), Payment Card Industry Data Security Standard (PCI DSS), Illinois School Student Records Act (ISSRA), preferred
• Ability to advise infrastructure and applications staff in securing their environments
• Strong written and verbal communication, interpersonal and collaboration skills
• Able to convey security information to non-technical end-users in a way that inspires adoption and adherence to all IT and Board security policies and programs
• Strong leadership and team building skills, e.g. ability to develop high performing teams united around a clear vision for serving schools and achieving student success

Conditions of Employment
As a condition of employment with the Chicago Public Schools (CPS), employees are required to:

• Establish/Maintain Chicago Residency - Employees are required to live within the geographic boundaries of the City of Chicago within six months of their CPS hire date and maintain residency throughout their employment with the district. The Chicago residency requirement does not apply to temporary/part-time positions, however, all CPS employees must be residents of Illinois.
• Be Fully Vaccinated Against COVID-19 - Unless approved for a medical or religious exemption, all employees are required to be up-to-date on COVID-19 vaccinations, including boosters, and to submit proof of vaccination to the district within 30 days of hire. "Up-to-date" on vaccination is defined as being at least two weeks past all primary vaccine doses and any applicable boosters.