{"id":2764347,"url":"https://alion.io/job/kleinfelder-chief-information-security-office","title":"Chief Information Security Office","company":{"id":2897008,"name":"Kleinfelder","domain":"kleinfelder.com","url":"https://alion.io/company/kleinfelder","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"head","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Diego, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":182548,"max":275000,"currency":"USD","period":"year","gross":null,"usd_annual":275000},"salary_estimate":null,"experience_years_min":12,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Least Privilege","optional":false},{"name":"Machine Learning","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-10-17T03:26:44Z","employer_posted_date":"2026-10-17","last_verified_at":"2026-10-17T16:43:38Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Job Description\nTake Your Corporate Career to the Next Level\nKleinfelder, a Forbes' Top Employer for Engineers in North America, is committed to a people-first culture, technical excellence, and creating opportunities where employees can thrive!\nAre you ready to be challenged, make a difference, and experience professional growth in your career? Kleinfelder’s Corporate Services team is looking for you! From Accounting & Finance, Human Resources, Marketing & Communications, and Information Technology to Legal and Health & Safety, our corporate employees are part of the Kleinfelder ecosystem - supporting the projects that improve the communities we work and live in.\nStep into Your New Role\nThe Chief Information Security Officer (CISO) is the enterprise executive accountable for the cybersecurity, information risk, privacy-supporting security, and cyber resilience program. The CISO establishes strategy, governance, architecture, and operating priorities that protect the organization, its clients, regulated data, intellectual property, and business operations while enabling growth, digital transformation, cloud adoption, artificial intelligence, and secure delivery of technology-enabled services.\nThe CISO advises executive leadership and the Board on material cyber risk, regulatory and contractual obligations, threat conditions, investment priorities, and risk acceptance. The role leads enterprise security, coordinates incident readiness and response, and partners with Information Technology, Legal, Privacy, Human Resources, Internal Audit, Procurement, Operations, and business leadership. The CISO also provides executive sponsorship for secure-by-design and DevSecOps practices and for federal compliance programs, including Controlled Unclassified Information (CUI), Federal Contract Information (FCI), NIST SP 800-171, DFARS cybersecurity requirements, and Cybersecurity Maturity Model Certification (CMMC).\nAccepting applications through November 6, 2026.\nKEY RESPONSIBILITIES\nEnterprise Security Strategy, Governance and Leadership\nOwn and maintain a multi-year enterprise cybersecurity strategy, operating model, roadmap, and investment plan aligned with business objectives, enterprise risk appetite, legal obligations, client commitments, and the evolving threat landscape.\nLead cybersecurity governance and provide concise, decision-ready reporting to executive leadership and the Board on risk posture, incidents, control effectiveness, program maturity, investment needs, and remediation progress.\nDefine clear accountability across the three lines model; establish enterprise security policies, standards, control objectives, exceptions, and risk acceptance processes with documented business ownership.\nBuild, lead, develop, and retain a high-performing security organization; define roles, succession plans, performance measures, and strategic sourcing models for internal and managed security capabilities.\nManage the cybersecurity operating and capital budgets, workforce plan, technology portfolio, and third-party services to optimize risk reduction and business value.\nCyber Risk, Compliance and Federal Contracting\nOwn the enterprise cyber risk management framework and maintain consistent methods for identifying, assessing, prioritizing, treating, accepting, monitoring, and reporting information security risk.\nPartnering with Director of Federal Compliance, provide executive oversight for federal cybersecurity compliance, including FCI and CUI scoping, shared-responsibility models, evidence retention, continuous monitoring, and assessment readiness.\nOversee implementation and sustainment of applicable requirements under CMMC, NIST SP 800-171 and related assessment objectives, DFARS cybersecurity clauses, FAR safeguarding requirements, governance for Systems Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), assessment results and contractual incident-reporting and information-protection obligations.\nPartner with Legal, Contracts, Procurement, Compliance, and business leaders to review solicitations and contract language, determine security obligations, flow down requirements to subcontractors, and prevent unsupported representations of compliance.\nCoordinate internal assessments, independent reviews, customer inquiries, regulator interactions, and CMMC assessment preparation; ensure findings are risk-ranked, assigned, funded, tracked, and validated to closure.\nMaintain alignment with other applicable frameworks and obligations such as the NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001, privacy requirements, state breach-notification laws, and client-specific requirements.\nSecurity Architecture, Cloud and DevSecOps\nEstablish enterprise security architecture principles and reference architectures for identity, endpoint, network, cloud, data, application, API, operational technology, and third-party connectivity.\nAct as executive sponsor for DevSecOps and secure software development lifecycle practices that integrate security into product and solution planning, architecture, coding, build, test, release, deployment, and operations.\nRequire risk-based security gates and automated controls in CI/CD pipelines, including source-code and dependency scanning, secrets detection, software composition analysis, infrastructure-as-code scanning, container and artifact assurance, and security testing appropriate to the technology and risk.\nEnsure engineering teams apply threat modeling, secure coding standards, code review, least privilege, environment segregation, change control, vulnerability remediation, logging, and security acceptance criteria.\nDefine governance for software supply-chain risk, open-source use, code provenance, artifact integrity, software bills of materials when required, third-party components, and secure release practices.\nPartner with technology and engineering leaders to create reusable security patterns, paved roads, guardrails, and metrics that improve developer experience while reducing risk and delivery friction.\nProvide security governance for cloud platforms, Infrastructure as Code, APIs, low-code/no-code platforms, citizen development, artificial intelligence, and machine learning use cases.\nSecurity Operations, Incident Response and Resilience\nOversee security monitoring, detection engineering, threat intelligence, vulnerability and exposure management, penetration testing, identity threat protection, endpoint security, email security, data protection, and security operations center capabilities.\nMaintain an enterprise cyber incident response program with defined severity criteria, decision rights, communications, legal and regulatory coordination, evidence preservation, customer notification support, and executive escalation.\nLead or coordinate response to material cyber incidents and ensure after-action reviews result in measurable corrective actions.\nPartner with business continuity, disaster recovery, crisis management, and operational leaders to validate recovery strategies, ransomware resilience, backup protection, and exercises for high-impact scenarios.\nDevelop measurable key risk and performance indicators that demonstrate control effectiveness, remediation velocity, resilience, and business impact rather than activity alone.\nData Protection, Third-Party Risk and Workforce Security\nEstablish security requirements for data classification, handling, retention, encryption, loss prevention, access governance, records protection, and secure disposal in partnership with Legal, Privacy, and data owners.\nOversee cybersecurity due diligence and lifecycle risk management for suppliers, software providers, cloud services, managed service providers, subcontractors, and other third parties.\nEnsure security requirements are incorporated into procurement, contracts, onboarding, monitoring, renewal, and termination processes, including federal flow-down obligations when applicable.\nLead enterprise security awareness, role-based training, phishing resilience, executive education, and privileged-user training programs; reinforce a culture of shared accountability for security.\nCoordinate insider-risk, personnel-security, physical-security, and workplace-safety interfaces with Human Resources, Legal, Facilities, and business leadership.\nPOSITION COMPETENCIES\nExecutive leadership and influence: translates complex cyber risk into business decisions and earns trust across technical, operational, legal, and executive audiences.\nRisk-based judgment: makes defensible decisions using evidence, business context, threat intelligence, materiality, and documented risk ownership.\nStrategic execution: converts strategy into funded roadmaps, accountable outcomes, measurable controls, and sustainable operating processes.\nCollaboration and enablement: partners with technology and business teams to implement secure solutions without unnecessary friction.\nCrisis leadership: communicates clearly, remains decisive under pressure, and coordinates cross-functional response to high-impact events.\nFinancial and commercial acumen: connects cyber investments and contractual obligations to business value, loss avoidance, client trust, and growth.\nEXPERIENCE AND ACADEMIC REQUIREMENTS\nEducation: Bachelor's degree or equivalent experience in Cybersecurity, Computer Science, Information Systems, Engineering, Business Administration, Risk Management, or a related field required. Master's degree or equivalent advanced study preferred.\nRequired Experience:\n12 or more years of progressive experience in cybersecurity, technology risk, information technology, engineering, or related disciplines, including significant enterprise security leadership responsibility.\n5 or more years leading managers, multidisciplinary security teams, or enterprise-wide security programs in a complex, distributed organization.\nDemonstrated experience advising executive leadership or a Board on material cyber risk, incidents, regulatory obligations, program maturity, and investment priorities.\nDemonstrated ownership of security strategy, governance, architecture, operations, incident response, third-party risk, vulnerability management, identity, data protection, and security awareness capabilities.\nExperience establishing or governing DevSecOps and secure SDLC practices across CI/CD pipelines, cloud platforms, application development, APIs, Infrastructure as Code, and software supply chains.\nExperience with federal contracting cybersecurity requirements, including CUI and FCI handling, NIST SP 800-171 implementation or assessment, DFARS cybersecurity obligations, CMMC scoping and readiness, SSPs, POA&Ms, evidence management, and supplier flow-downs.\nExperience managing budgets, vendors, managed services, workforce plans, and multi-year transformation roadmaps.\nExperience operating in a highly regulated, project-based, engineering, professional services, critical infrastructure, or similarly complex environment preferred.\nTechnical and Business Knowledge:\nWorking knowledge of modern enterprise architecture, cloud security, Zero Trust, identity and access management, data security, security operations, threat and vulnerability management, privacy-supporting controls, resilience, and secure software development.\nAbility to interpret laws, regulations, standards, contractual clauses, and customer requirements and translate them into practical governance, control, evidence, and accountability models.\nAbility to communicate technical and compliance issues in concise business language, including consequences, options, cost, and residual risk.\nCERTIFICATIONS\nOne or more senior cybersecurity certifications such as CISSP, CISM, CCSP, CRISC or equivalent is strongly preferred. Additional credentials in cloud security, risk, privacy, secure software development, federal compliance, or CMMC assessment are advantageous.\nFollowing an offer, candidates will be required to satisfactorily complete employment reference checks...","description_format":"text","description_chars":14918,"description_truncated":true,"requirements":{"experience_years_min":12,"management_years_min":5,"team_size_min":null,"manages_managers":false,"education":{"level":"master","optional":true},"security_clearance":false,"languages":[]},"benefits":["Equity","Life insurance","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Civil & Structural Engineering","Environmental Science","Testing, Inspection & Certification"],"lifecycle":[{"event":"open","at":"2026-10-17T03:26:44Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":3,"reasons":["conf:2","win:early","comp:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":275000,"is_top_pay":true},"html_url":"https://alion.io/job/kleinfelder-chief-information-security-office","json_url":"https://alion.io/job/kleinfelder-chief-information-security-office.json","meta":{"generated_at":"2026-10-17T18:41:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1554,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2897008},"rest":"https://alion.io/mcp/rest/get_company?id=2897008"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkleinfelder-chief-information-security-office"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkleinfelder-chief-information-security-office"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkleinfelder-chief-information-security-office"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kleinfelder-chief-information-security-office\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkleinfelder-chief-information-security-office"}]}