Information Security Officer

The Virginia Information Technologies Agency (VITA) is excited to offer a competitive opportunity to serve as an Information Security Officer with the Commonwealth Security Risk Management Division.

The Information Security Officer establishes, leads, and continuously matures VITA’s enterprise information security program, encompassing security policy, risk management, security architecture, incident response, and workforce training.

The position’s scope covers the entirety of VITA’s information systems, applications, and data, and because VITA delivers shared technology services to other Commonwealth agencies, the security of VITA’s own environment directly affects the agencies that depend on those services. The ISO reports organizationally within VITA while operating under the direction of the Commonwealth CISO and serves as the agency’s principal point of contact on security matters for the Agency Head, external auditors, and oversight bodies.

This is a high-visibility, high-accountability position. The ISO is designated under Section 2.2-2009 of the Code of Virginia and is personally accountable to the Agency Head and the Commonwealth CISO for the security posture of the entire agency. The role requires sustained availability during active security incidents, including after-hours and weekend response to threats and breaches, and operates under continuous compliance and audit scrutiny.

Candidates should expect a demanding pace, direct exposure to executive leadership, and full accountability for outcomes affecting the confidentiality, integrity, and availability of VITA’s information systems.

Core duties:

Develop, implement, and continuously mature security and data protection solutions that protect the confidentiality, integrity, and availability of VITA’s information assets.

Assess requirements and provide guidance on additional security services, promoting sound security practices agency wide.

Develop new services, standards, and operating procedures that let the agency address information security risk and comply with applicable laws and regulations.

Lead the agency’s information security planning process to establish and maintain a comprehensive information security program, per SEC-530 Section 2.5.

Join VITA at The Boulders in Richmond, VA, where innovation meets impact! As the Commonwealth’s leading IT agency, we’re connecting, protecting, innovating, and powering Virginia’s digital future through collaboration, creativity, and purpose. Our team thrives in a vibrant, customer-focused environment that values growth, accountability, and forward thinking - all while making technology work for every corner of Virginia., VITA is a “Virginia Values Veterans” (V3) official certified state agency that provides hiring preference to Veterans and Members of the Virginia National Guard in support of Executive Order 29, (2010). If you are a Veteran or Virginia National Guard Member, we encourage you to apply and receive preference in the hiring process. AmeriCorps, Peace Corps and other national service alumni also are encouraged to apply.

Extensive knowledge of IT security architecture and security control implementation.

Extensive experience in security program management and incident response.

Extensive experience building, leading, and managing an information security program.

Extensive experience with enterprise IT systems and security tools.

Extensive experience interpreting and applying federal and state laws, regulations, and security standards, including NIST SP 800-53 and the Commonwealth’s SEC-530 Information Security Standard.

Extensive experience developing and implementing information security policies and standards.

Knowledge and experience in strategic planning for information security programs.

Experience in disaster recovery planning and the development and implementation of disaster recovery (DR) programs.

Additional Considerations

Knowledge of and experience with programs and operations within the Commonwealth’s shared IT services model.

Knowledge of budgetary processes and principles.

Professional CISSP (Certified Information Systems Security Professional) certification.

Experience with project management and/or change management.