Virtual Chief Information Security Officer (vCISO)

The vCISO functions as a trusted executive advisor and named security leader for assigned customers. This position owns the customer security program at a strategic level, including security roadmaps, governance cadence, executive reporting, risk prioritization, audit readiness, vendor oversight, and incident response leadership. The vCISO also supports Meriplex customer engagement by participating in executive meetings, assisting with security questionnaires and RFP responses, advising on pre-sales opportunities, and translating technical security needs into clear business outcomes., Leadership and Strategy

• Serve as the fractional executive security leader for assigned customers, owning security strategy, program direction, governance cadence, and executive-level risk communication.
• Develop and maintain cybersecurity roadmaps aligned to customer business objectives, regulatory drivers, risk appetite, maturity level, and budget priorities.
• Brief executive leadership, boards, and key stakeholders on security posture, material risks, program progress, incident readiness, and recommended investment decisions.
• Establish security governance models, steering committees, decision logs, metrics, and accountability structures that allow customers to manage cybersecurity as a business function.

Compliance and Risk Management

• Lead compliance and audit readiness efforts for frameworks and regulations such as HIPAA, SOC 2, NIST CSF, PCI DSS, and other customer-specific requirements.
• Own risk assessment activities, risk registers, remediation plans, evidence collection oversight, and executive reporting on residual risk and control gaps.
• Coordinate with auditors, regulators, cyber insurance providers, legal teams, and customer leadership to support assessments, attestations, security questionnaires, and remediation commitments.
• Translate compliance requirements into practical control improvements, prioritized workstreams, and business-ready recommendations that customers can fund and execute.

Security Operations:

• Oversee the effectiveness of customer security operations, including monitoring capabilities, endpoint protection, identity controls, vulnerability management, backup readiness, and response processes.
• Direct incident response planning and execution, including tabletop exercises, escalation paths, executive communications, post-incident reviews, and remediation tracking.
• Advise customers on security tooling, vendor selection, solution rationalization, and managed service alignment to ensure investments reduce measurable business risk.
• Coordinate with Meriplex delivery, SOC, engineering, account management, and customer teams to ensure governance recommendations are translated into operational execution.

Collaboration and Communication:

• Represent Meriplex and assigned customers in executive meetings, board-level discussions, audit meetings, customer security reviews, and strategic planning sessions.
• Communicate cybersecurity risk, strategy, program maturity, and recommended actions in clear business language suitable for executives, boards, non-technical leaders, and client stakeholders.
• Support MSP/MSSP customer growth activities by assisting with pre-sales conversations, renewal discussions, security questionnaires, RFP responses, and customer-facing advisory sessions.
• Partner with sales, account management, and service delivery teams to identify customer security needs, clarify business value, and shape practical cybersecurity roadmaps.

• Minimum of 5 years of progressive experience across cybersecurity leadership, risk management, governance, compliance, security operations, or IT advisory roles.
• Demonstrated ability to operate as a fractional executive advisor, influence senior leaders, brief boards, and guide cybersecurity decisions in business terms.
• Strong working knowledge of security and compliance frameworks including HIPAA, NIST CSF, SOC 2, and PCI DSS.
• Experience leading security assessments, audit readiness, incident response planning, tabletop exercises, security roadmaps, and risk remediation programs.
• Ability to support customer-facing advisory work, executive presentations, security questionnaires, RFP responses, and pre-sales technical discussions.
• Excellent communication, prioritization, consulting, and relationship management skills with the ability to manage multiple customers, competing deadlines, and executive expectations.

Education/ Experience:

• Bachelor’s degree from an accredited university/college preferred; equivalent executive cybersecurity, risk, compliance, or advisory experience may be considered.
• Proven experience in client relationship management, executive advisory, governance, audit support, and customer-facing cybersecurity services within an MSP, MSSP, consulting, or managed services environment.

Certifications:

• Cybersecurity credentials such as CISSP, CISM, CISA, CRISC, or equivalent are strongly preferred.

Physical Demands:

Sedentary Work - Exerts up to 10 pounds of force occasionally, a negligible amount of force frequently, and/or constantly having to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time.