Division Head, Information Security

J

Position Description:

Position Summary

The National Radio Astronomy Observatory (NRAO) is a prestigious research and development organization that plays a vital role in the study of the universe. Associated Universities, Inc. (AUI) is a nonprofit organization that manages and operates the NRAO under a cooperative agreement with the National Science Foundation. The Observatory is a hub for technological and scientific collaboration, operating state-of-the-art radio telescope facilities for use by the international scientific community. The Observatory has been instrumental in the study of black holes, galaxies, and the early universe.

NRAO is seeking an experienced information security professional or chief information security officer (CISO) for our Division Head, Information Security opportunity. The Division Head (DH) provides strategic, operational, and technical leadership for the National Radio Astronomy Observatory's enterprise information security program. Reporting directly to the Deputy Chief Information Officer, the DH is responsible for establishing, implementing, and sustaining a comprehensive cybersecurity strategy that protects the Observatory's scientific, operational, and enterprise technology environments while enabling the continued advancement of its scientific mission.

The DH will lead a significant transformation of the Observatory's information security capabilities, addressing existing security vulnerabilities, reducing the organization's exposure to cyber threats, and establishing the foundational security processes, technologies, governance structures, and operational disciplines necessary to achieve a mature and sustainable cybersecurity posture. This position requires a leader capable of building and modernizing security capabilities in an environment where critical security controls, operational processes, and supporting technologies are either immature, inconsistently implemented, or not yet established.

This position demands more than traditional policy oversight or compliance administration. The DH must possess the technical credibility to engage directly with infrastructure engineers, network architects, system administrators, scientific computing specialists, and application development teams to understand complex security exposures and develop practical, effective remediation strategies. Equally important, the successful candidate must demonstrate the organizational leadership necessary to build a sustainable cybersecurity function, establish accountability across distributed technology teams, and guide meaningful cultural and operational change.

This position will be based in Albuquerque, NM, Socorro, NM, Charlottesville, VA or Green Bank, WV. For well-qualified candidates, a remote work arrangement may be considered.

What You Will be Doing

The DH reports directly to the Deputy Chief Information Officer and serves as the Observatory's senior leader responsible for enterprise cybersecurity strategy, governance, risk management, and security operations.

The DH is expected to work collaboratively with the Associate Director of Data Management and Software, Deputy CIO, technology architects, infrastructure engineering, Science IT, and other organizational stakeholders to establish security requirements and coordinate their implementation.

The position is responsible for defining cybersecurity policies, standards, control requirements, and risk management processes, while partnering with the appropriate technology owners to implement and maintain those controls.

The DH will provide regular cybersecurity posture assessments, material risk reports, remediation progress updates, and investment recommendations to the Deputy CIO and other designated Observatory leadership. The duties and responsibilities of the DH will include, but are not limited to:

Lead the transformation of the Observatory's cybersecurity posture by identifying and addressing systemic security weaknesses, architectural vulnerabilities, immature operational processes, and gaps in security technologies and controls.

Develop, implement, and maintain a comprehensive enterprise information security strategy aligned with the Observatory's scientific mission, organizational priorities, and technology modernization initiatives.

Establish an enterprise cybersecurity operating model defining security functions, processes, responsibilities, accountability, service delivery expectations, and collaboration with other technology organizations.

Balance the need for effective cybersecurity controls with the Observatory's requirements for scientific openness, high-performance computing, external collaboration, and operational flexibility.

Develop, maintain, and enforce cybersecurity policies, standards, procedures, and technical control requirements across the Observatory.

Develop governance mechanisms for reviewing the security implications of technology acquisitions, infrastructure modernization, software development, and scientific computing initiatives.

Ensure cybersecurity requirements are integrated into technology architecture standards, operational procedures, procurement activities, and project delivery

Other duties may be assigned.

Work Environment

The successful candidate will join a team of professionals engaged in research and development in the fields of science, engineering, software development, and education.  Work is typically performed in a research or development environment.  Must be able to operate a personal computer. Occasional travel (domestic and international) may be required.

Who You Are:

Education

A Bachelor’s degree in in Cybersecurity, Information Assurance, Computer Science, Engineering, or a related discipline; highly relevant experience may be considered in lieu of a Bachelor's degree.

Experience

Minimum seven years of extensive technical knowledge and experience directing staff in the support of scientific or technical research. 

Required Skills, Competencies and Experience

Security Governance and Risk Management

Comprehensive understanding of NIST CSF, and other recognized cybersecurity standards and control frameworks.

Experience establishing enterprise security policies, control standards, risk assessment processes, and compliance programs.

Experience conducting cybersecurity maturity assessments and translating findings into prioritized remediation initiatives.

Demonstrated ability to develop risk-based security investment strategies and measurable program improvement objectives.

Security Operations

Experience establishing or leading security operations and incident response capabilities.

Experience developing incident response procedures, operational playbooks, and security monitoring standards.

Demonstrated ability to coordinate technical remediation activities across multiple engineering and operations teams.

Leadership and Organizational Transformation

Demonstrated ability to lead significant cybersecurity improvement initiatives in organizations with immature or inconsistently implemented security controls.

Strong organizational change management, stakeholder engagement, and cross-functional leadership skills.

Ability to establish governance and accountability while maintaining productive working relationships with scientific and technical communities.

Experience managing budgets, vendor relationships, technology investments, and multidisciplinary security teams.

The following are highly preferred:

Professional certifications such as CISSP, CISM, CISA, CRISC, or equivalent advanced cybersecurity credentials.

Experience serving as a CISO, Deputy CISO, Director of Information Security, or equivalent cybersecurity executive.

Experience developing or transforming cybersecurity programs within research institutions, national laboratories, universities, federally funded research organizations, or other scientific computing environments.

Familiarity with the cybersecurity challenges associated with high-performance computing, scientific instrumentation, research networks, and large-scale data processing.

Experience securing Linux-intensive infrastructure environments and open-source technology ecosystems.

Familiarity with research and education identity federation, distributed authentication, and scientific collaboration platforms.

Familiarity with federal cybersecurity requirements, contractual security obligations, and security expectations applicable to federally funded research organizations.

Experience developing cybersecurity metrics, executive scorecards, and security maturity reporting frameworks.

Additional Requirement

Observatory employees must be authorized to work in the United States. The Observatory presently cannot sponsor H-1B Visas for this position.

Total Rewards:

Compensation

The starting salary of this position is between $130,000 and $160,000. Factors which may affect starting pay within this range may include; education, experience, skills, competencies, other qualifications of the successful candidate, as well as internal equity and labor market conditions.

Benefits:

Associated Universities, Inc (AUI) offers a comprehensive benefits package addressing the needs of employees and their families with most benefits beginning on the first day of employment, subject to eligibility requirements. AUI provides:

Excellent paid time off (13 holidays, annual accrual of up to 24 vacation days)

Medical, dental and vision plans are effective on the first day of employment.

AUI’s retirement benefit contributes an amount equal to 10 percent of a qualified participant’s base pay with no required employee contribution.

Click Total Rewards for more information.

Application Instructions:

Select the “Apply” button above. Please be prepared to upload your current CV/Resume and a cover letter describing interest and suitability for the position.

Equal Opportunity Employer Statement:

AUI is an equal opportunity employer. To view our complete statement, please visit https://public.nrao.edu/careers/. If you require reasonable accommodation for any part of the application or hiring process, you may submit your request by sending an email to [email protected]. PM20