Virtual Chief Information Security Officer/Cyber Security Principal

Salary Range: 150000 to 175000 (Currency: USD) (Pay period: per-year-salary)

Key Responsibilities

Client Executive Advisory and Engagement Leadership

• Serve as the primary trusted cybersecurity advisor to client executives, leadership teams, and boards for assigned accounts.

• Establish engagement objectives, governance, decision rights, meeting cadence, success measures, and executive reporting expectations.

• Translate technical findings, threat conditions, and compliance obligations into business impact, clear choices, and prioritized actions.

• Build durable client relationships through proactive communication, sound judgment, transparency, and follow-through.

• Manage multiple client programs while maintaining quality, consistency, and responsiveness.

Cybersecurity Strategy, Governance, and Maturation

• Assess current-state program maturity and define target-state capabilities using the framework most appropriate to each client.

• Develop and maintain multi-year cybersecurity maturation roadmaps aligned to business strategy, budgets, risk tolerance, and regulatory requirements.

• Create or improve governance structures, policies, standards, risk registers, performance measures, and reporting mechanisms.

• Guide security budgeting, investment prioritization, and risk-treatment decisions.

• Define meaningful key risk and performance indicators and use them to demonstrate progress and support executive decisions.

Risk, Compliance, Resilience, and Third-Party Oversight

• Lead or guide cybersecurity risk assessments, gap assessments, and remediation planning.

• Advise clients on alignment with NIST CSF, NIST 800-53/171, CIS Controls, ISO 27001, CMMC, PCI DSS, HIPAA, and SOC 2, as applicable.

• Support audit and assessment readiness without representing Tusker as the independent auditor or attestation body.

• Lead third-party risk discussions, vendor due diligence, and risk-based review of critical service providers.

• Develop, review, and exercise incident response and cyber resilience plans, including executive and board-level tabletop exercises.

• Advise on the secure adoption of cloud, AI, and emerging technologies.

Tusker Delivery and Growth Collaboration

• Coordinate with Tusker Solution Architects, technical delivery teams, Managed Services, Advisory, Sales, and external partners to translate roadmaps into executable work.

• Clarify ownership, dependencies, timing, and expected outcomes across strategic and technical workstreams.

• Provide cybersecurity subject-matter expertise during qualified sales pursuits, client workshops, renewals, and expansion discussions.

• Help shape repeatable vCISO methods, templates, reporting, service standards, and quality controls.

• Mentor colleagues and strengthen the ability of Tusker teams to identify advisory needs and engage the right resources.

Required Qualifications

• 12 or more years of progressive cybersecurity experience, including significant responsibility for cybersecurity strategy, governance, risk, compliance, and program leadership.

• Experience serving as a CISO, vCISO, deputy CISO, security executive, or equivalent senior cybersecurity leader.

• Demonstrated ownership of cybersecurity programs, budgets, risk decisions, executive reporting, and board-level communication.

• Proven ability to lead strategic assessments, create multi-year roadmaps, and guide security-program maturation.

• Strong working knowledge of NIST CSF, NIST 800-53/171, CIS Controls, ISO 27001, CMMC, PCI DSS, HIPAA, and SOC 2.

• Experience leading incident response planning, executive exercises, third-party risk activities, and governance or policy programs.

• Executive-level communication, facilitation, writing, and presentation skills, with the ability to communicate clearly to technical and non-technical audiences.

• Ability to lead through influence across client teams, Tusker teams, and external providers.

• Ability to manage multiple concurrent client engagements and operate effectively in ambiguous situations.

• High ethical standards, discretion, and professional integrity.

• Candidate should reside within approximately two hours driving distance of Chicago and be able to travel periodically based on client and business needs.

Preferred Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Business, or a related field; advanced degree is a plus.

• One or more relevant certifications, including CISSP, CISM, CRISC, CISA, CDPSE, or CIPP.

• Experience delivering vCISO, cybersecurity advisory, consulting, MSP, or MSSP services to mid-market clients.

• Experience in regulated industries such as healthcare, financial services, manufacturing, education, public sector, or organizations in the defense industrial base.

• Familiarity with GRC platforms, compliance automation, common security operations capabilities, and the commercial realities of outsourced service delivery.