vCISO/Cyber Security Principal
Confirmed on the employer's own hiring board on Oct 20, 2026. First seen by Alion on Oct 6, 2026.
Tusker is a nationwide technology solutions and services company helping organizations solve complex IT challenges and move their businesses forward. Our expertise spans cloud infrastructure, cybersecurity, managed services, modern workplace, AI, and more. We’re a growing team that values strong relationships, fresh thinking, and doing great work-for our clients and for each other. It all comes back to a simple philosophy that guides who we are: People First. Always.
The Cyber Security Principal is a senior, client-facing cybersecurity advisor who performs the function of a virtual Chief Information Security Officer (vCISO) for assigned Tusker clients. The role leads executive advisory relationships and helps clients build, govern, and mature cybersecurity programs that align security investment with business priorities, regulatory obligations, and risk tolerance.
The Cyber Security Principal owns the strategic direction and operating cadence of assigned engagements while coordinating the broader Tusker team responsible for assessment, architecture, implementation, managed services, and program support. Success requires executive presence, practical judgment, strong program discipline, and the ability to convert complex cyber risk into clear decisions, sequenced roadmaps, and measurable outcomes.
Key Responsibilities
Serve as the primary trusted cybersecurity advisor to client executives, leadership teams, and boards for assigned accounts.
Establish engagement objectives, governance, decision rights, meeting cadence, success measures, and executive reporting expectations.
Translate technical findings, threat conditions, and compliance obligations into business impact, clear choices, and prioritized actions.
Build durable client relationships through proactive communication, sound judgment, transparency, and follow-through.
Manage multiple client programs while maintainingquality, consistency, and responsiveness.
Assess current-stateprogram maturity and define target-state capabilities using the framework most appropriate toeach client.
Develop and maintainmulti-year cybersecurity maturation roadmaps aligned to business strategy, budgets, risk tolerance, and regulatory requirements.
Create or improve governance structures, policies, standards, risk registers, performance measures, and reporting mechanisms.
Guidesecurity budgeting, investment prioritization, and risk-treatment decisions.
Define meaningful key risk and performance indicators and use them to demonstrate progress and support executive decisions.
Lead or guide cybersecurity risk assessments, gap assessments, and remediation planning.
Advise clients on alignment with NIST CSF, NIST 800-53/171, CIS Controls, ISO 27001, CMMC, PCI DSS, HIPAA, and SOC 2, as applicable.
Support audit and assessment readiness without representing Tusker as the independent auditor or attestation body.
Lead third-party risk discussions, vendor due diligence, and risk-based review of critical service providers.
Develop, review, and exercise incident response and cyber resilience plans, including executive and board-level tabletop exercises.
Advise onthe secure adoption of cloud, AI, and emerging technologies.
Coordinate with Tusker Solution Architects, technical delivery teams, Managed Services, Advisory, Sales, and external partners to translate roadmaps into executable work.
Clarify ownership, dependencies, timing, and expected outcomes across strategic and technical workstreams.
Provide cybersecurity subject-matterexpertiseduring qualified sales pursuits, client workshops, renewals, and expansion discussions.
Help shape repeatable vCISOmethods, templates, reporting, service standards, and quality controls.
Mentor colleagues and strengthen the ability of Tusker teams to identifyadvisory needs and engagethe right resources.
Client Executive Advisory and Engagement Leadership
Cybersecurity Strategy, Governance, and Maturation
Risk, Compliance, Resilience, and Third-Party Oversight
Tusker Delivery and Growth Collaboration
Required Qualifications
12 or more years of progressive cybersecurity experience, including significant responsibility for cybersecurity strategy, governance, risk, compliance, and program leadership.
Experience serving as a CISO, vCISO, deputy CISO, security executive, or equivalent senior cybersecurity leader.
Demonstrated ownership of cybersecurity programs, budgets, risk decisions, executive reporting, and board-level communication.
Proven ability to lead strategic assessments, create multi-year roadmaps, and guide security-program maturation.
Strong working knowledge of NIST CSF, NIST 800-53/171, CIS Controls, ISO 27001, CMMC, PCI DSS, HIPAA, and SOC 2.
Experience leading incident response planning, executive exercises, third-party risk activities, and governance or policy programs.
Executive-level communication, facilitation, writing, and presentation skills, with the ability to communicate clearly to technical and non-technical audiences.
Ability to lead through influence across client teams, Tusker teams, and external providers.
Ability to manage multiple concurrent client engagements and operateeffectively in ambiguous situations.
High ethical standards, discretion, and professional integrity.
Candidateshould residewithin approximately two hours driving distance of Boston and be able to travel periodically based on client and business needs.
Preferred Qualifications
Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Business, or a related field; advanced degree is a plus.
One or more relevant certifications, including CISSP, CISM, CRISC, CISA, CDPSE, or CIPP.
Experience delivering vCISO, cybersecurity advisory, consulting, MSP, or MSSP services to mid-market clients.
Experience in regulated industries such as healthcare, financial services, manufacturing, education, public sector, or organizations in the defense industrialbase.
Familiarity with GRC platforms, compliance automation, common security operations capabilities, and the commercial realities of outsourced service delivery.