Virtual CISO (vCISO) / Cybersecurity Program Lead
Abacus
3 days ago
Contract
Remote
United States
| Job Title | Virtual CISO (vCISO) / Cybersecurity Program Lead | ||||||||
| Client Company/Dept. Name | Western Wyoming Community College | ||||||||
| Address | 2500 College Drive, E-460 | City Name | Rock Springs | State Name | WY-Wyoming | Zip Code | 82901 | If others (Address) | |
| Duration of the project | Project Start Date | Nov. 13, 2026 | Project End Date | 3-year initial term, with renewal options | Due date for Resume submission | 10/15/2026 | |||
| No. of Openings | 1 | No. of Maximum Submissions | 1 | ||||||
| Job Description | Role summary: WWC has an information security analyst but no designated CISO (Addendum 1). The vCISO owns WWC's cybersecurity program end to end: strategy, NIST-aligned controls, risk, policy and incident readiness. They lead the SOC, engineering and GRC leads and mentor WWC's security analyst. Reports to: Fractional CIO (integrated governance model permitted when CIO and cybersecurity are awarded together, per Addendum 1) Direct reports: SOC & IR Lead, Security Engineering Lead, GRC & Compliance Lead; dotted line to WWC's information security analyst Location: US-based; remote, with quarterly onsite visits and onsite presence during major incidents if needed Allocation: 0.3–0.4 FTE; 24/7 on-call escalation for critical incidents Key responsibilities: • Lead the cybersecurity Discovery & Assessment: a security posture baseline, NIST CSF 2.0 maturity scoring, and a review of existing tools and prior assessments (shared with the vendor after award). • Produce the cybersecurity 90-day plan and a 3-year security roadmap. • Recommend and govern the security monitoring model (24/7 SOC/MDR), using the Microsoft 365 A5 security stack (Defender XDR, Sentinel, Entra ID P2, Purview) where it makes sense. • Own risk assessment and mitigation planning; maintain the cyber risk register; deliver the annual cybersecurity risk report to WWC leadership. • Develop and approve cybersecurity policies (information security, acceptable use, access control, incident response, data classification, vendor risk). • Own incident response planning and serve as incident commander for major incidents; coordinate with WWC leadership, legal counsel, cyber insurance carrier and law enforcement. • Oversee the GLBA Safeguards Rule information security program, FERPA safeguards and regulatory compliance support. • Run the security awareness strategy for faculty, staff and administration (about 510 users). • Advise on DR/BC strategy, cloud security and third-party/vendor security risk. • Present cybersecurity posture to the CIO, cabinet and Board. Deliverables owned: security assessment reports, the cybersecurity 90-day plan, the annual cybersecurity risk report, cybersecurity policy set, the incident response plan (with SOC & IR Lead), and quarterly security posture reports. |
||||||||
| Skill set info | Experience: 15+ years in information security, including 7+ years as CISO, vCISO or security program leader Required qualifications: • 15+ years in cybersecurity, including 7+ years leading security programs as CISO or vCISO; higher education experience strongly preferred. • Deep expertise in NIST CSF 2.0 and NIST SP 800-53/800-171, plus FERPA, GLBA Safeguards Rule (16 CFR 314) and PCI DSS. • Has built or matured security programs in Microsoft 365 / Azure environments. • Has led real incident response engagements, including ransomware and business email compromise. • Strong executive and board communication. • Bachelor's degree in Cybersecurity, IT or Computer Science; Master's preferred. Preferred: vCISO experience with colleges or universities; experience with the higher-education information sharing center (REN-ISAC) and the EDUCAUSE HECVAT security questionnaire. |
||||||||
| Education | Bachelor's degree in Cybersecurity, IT or Computer Science; Master's preferred. | ||||||||
| Certifications (if required) | Certifications (required: at least one of): CISSP, CISM. Preferred: CISA, CRISC, CCISO, GIAC GSLC or GSTRT. | ||||||||
| Documentation Required for submission | Updated Resume | ||||||||
| Work Hours | 0.3–0.4 FTE; 24/7 on-call escalation for critical incidents | ||||||||
| Account Manager Name (Proposal Team) | |||||||||
| Work authorization required | USC/GC/EAD/H1 also | ||||||||
| Relocation is accepted | No | ||||||||
| Remote work | Yes, remote is fine. Quarterly onsite visits and onsite presence during major incidents if needed | ||||||||
| Additional Notes if any | Candidate can be based anywhere in the US. Being located in or near Rock Springs, Wyoming is a preference only, not a requirement. Quarterly onsite visits, and onsite presence during major incidents if needed. | ||||||||
By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at Privacy Policy - Abacus.