Virtual CISO (vCISO) / Cybersecurity Program Lead

Job Description

Job Description Job Title Virtual CISO (vCISO) / Cybersecurity Program Lead Client Company/Dept. Name Western Wyoming Community College Address 2500 College Drive, E-460 City Name Rock Springs State Name WY-Wyoming Zip Code 82901 If others (Address) Duration of the project Project Start Date Nov. 13, 2026 Project End Date 3-year initial term, with renewal options Due date for Resume submission 10/15/2026 No. of Openings 1 No. of Maximum Submissions 1 Job Description Role summary: WWC has an information security analyst but no designated CISO (Addendum 1). The vCISO owns WWC's cybersecurity program end to end: strategy, NIST-aligned controls, risk, policy and incident readiness. They lead the SOC, engineering and GRC leads and mentor WWC's security analyst.
Reports to: Fractional CIO (integrated governance model permitted when CIO and cybersecurity are awarded together, per Addendum 1)
Direct reports: SOC & IR Lead, Security Engineering Lead, GRC & Compliance Lead; dotted line to WWC's information security analyst
Location: US-based; remote, with quarterly onsite visits and onsite presence during major incidents if needed
Allocation: 0.3 0.4 FTE; 24/7 on-call escalation for critical incidents

Key responsibilities:
" Lead the cybersecurity Discovery & Assessment: a security posture baseline, NIST CSF 2.0 maturity scoring, and a review of existing tools and prior assessments (shared with the vendor after award).
" Produce the cybersecurity 90-day plan and a 3-year security roadmap.
" Recommend and govern the security monitoring model (24/7 SOC/MDR), using the Microsoft 365 A5 security stack (Defender XDR, Sentinel, Entra ID P2, Purview) where it makes sense.
" Own risk assessment and mitigation planning; maintain the cyber risk register; deliver the annual cybersecurity risk report to WWC leadership.
" Develop and approve cybersecurity policies (information security, acceptable use, access control, incident response, data classification, vendor risk).
" Own incident response planning and serve as incident commander for major incidents; coordinate with WWC leadership, legal counsel, cyber insurance carrier and law enforcement.
" Oversee the GLBA Safeguards Rule information security program, FERPA safeguards and regulatory compliance support.
" Run the security awareness strategy for faculty, staff and administration (about 510 users).
" Advise on DR/BC strategy, cloud security and third-party/vendor security risk.
" Present cybersecurity posture to the CIO, cabinet and Board.

Deliverables owned: security assessment reports, the cybersecurity 90-day plan, the annual cybersecurity risk report, cybersecurity policy set, the incident response plan (with SOC & IR Lead), and quarterly security posture reports. Skill set info Experience: 15 years in information security, including 7 years as CISO, vCISO or security program leader

Required qualifications:
" 15 years in cybersecurity, including 7 years leading security programs as CISO or vCISO; higher education experience strongly preferred.
" Deep expertise in NIST CSF 2.0 and NIST SP 800-53/800-171, plus FERPA, GLBA Safeguards Rule (16 CFR 314) and PCI DSS.
" Has built or matured security programs in Microsoft 365 / Azure environments.
" Has led real incident response engagements, including ransomware and business email compromise.
" Strong executive and board communication.
" Bachelor's degree in Cybersecurity, IT or Computer Science; Master's preferred.

Preferred: vCISO experience with colleges or universities; experience with the higher-education information sharing center (REN-ISAC) and the EDUCAUSE HECVAT security questionnaire. Education Bachelor's degree in Cybersecurity, IT or Computer Science; Master's preferred. Certifications (if required) Certifications (required: at least one of): CISSP, CISM. Preferred: CISA, CRISC, CCISO, GIAC GSLC or GSTRT. Documentation Required for submission Updated Resume Work Hours 0.3 0.4 FTE; 24/7 on-call escalation for critical incidents Account Manager Name (Proposal Team) Work authorization required USC/GC/EAD/H1 also Relocation is accepted No Remote work Yes, remote is fine. Quarterly onsite visits and onsite presence during major incidents if needed Additional Notes if any Candidate can be based anywhere in the US. Being located in or near Rock Springs, Wyoming is a preference only, not a requirement. Quarterly onsite visits, and onsite presence during major incidents if needed.