Vice President of Information Security and Infrastructure

The Vice President of Information Security and Infrastructure reports to the Chief Information Officer and leads ACE's enterprise cybersecurity, technology risk, infrastructure, and operational resilience efforts. This leader sets the direction for information security and infrastructure, establishes the policies and governance needed to manage risk, and ensures ACE has a secure, reliable, and resilient technology environment. The role advises the CIO, executive leadership, and appropriate Board committees on significant cyber risks, regulatory requirements, major incidents, risk decisions, and technology investments. The Vice President sets clear security expectations, brings the right leaders together to address risk, and ensures significant risks are understood and acted upon. The role balances security and resilience with business needs and cost, while ensuring technology continues to support the College's growth and strategic priorities. Compensation ACE is committed to paying a competitive wage while staying true to our mission of maintaining high quality, affordable programs for our students. The starting salary range for this position is $240,000 plus all full-time employees are eligible for an annual bonus. Offers vary depending on education, prior experience, and expertise being applied to the role. What We Look for in the Ideal Candidate • Executive level communication skills. Must have exceptional communication, organization, and time management skills. • Demonstrates self-reliance by meeting/exceeding workflow needs. • Demonstrates positive attitude and motivation, concern for students, teamwork, and excellent time management skills. • Follows established processes as outlined by organization and leadership. • Completes assigned duties based on daily business needs and individual skill set. • Consistently produces a high volume of quality work. • Capable, adapts as needed, to work under pressure and meet tight deadlines. • Proven ability to work independently with limited supervision and with other department personnel. • Must support and embrace the College's Impact mission to improve the people and communities we serve through our civic engagement initiatives. • Must have exceptional communication, organization, and time management skills. • Must be "self-motivated" as well as creative and efficient in proposing solutions to complex, time-critical problems. • Must be collaborative in driving decisions and a team-player. • Strong analytical and problem-solving skills with a high attention to detail. • Builds and maintains student satisfaction. • Recognizes and anticipates student needs. Day to Day Responsibilities In this role you will wear different hats, but your skills will be especially essential in the following areas: • Partner with the CIO and executive leadership to define and execute multi-year cybersecurity, infrastructure, cloud, identity, and operational resilience strategies aligned with ACE's strategic plan, institutional risk appetite, student experience, growth objectives, and financial priorities. • Serve as ACE's senior executive authority for enterprise cybersecurity risk. Advise the CIO, executive leadership, and appropriate Board committees on material threats, regulatory exposure, control effectiveness, security investments, significant incidents, and risk-treatment decisions. • Own the enterprise cybersecurity program and roadmap using NIST Cybersecurity Framework 2.0 or a comparable recognized framework, including current-state and target profiles, maturity objectives, risk-based priorities, funding requirements, accountable owners, and measurable risk-reduction outcomes. • Own ACE's information security governance framework, including policies, standards, control requirements, risk-acceptance criteria, exception management, compliance monitoring, enforcement, annual review, and evidence of control operation. • Establish and maintain policies and standards covering acceptable use, identity and access management, data classification and handling, encryption, secure configuration, vulnerability and patch management, logging and monitoring, incident response, third-party risk, cloud security, secure development, business continuity, disaster recovery, artificial intelligence, records retention, and secure disposal. • Exercise authority to require remediation of material security weaknesses, approve or reject security exceptions, restrict high-risk technology use, and escalate unresolved or unacceptable risks to the CIO and designated executive governance bodies for formal risk acceptance. • Establish clear cybersecurity decision rights, control ownership, accountability, and governance across technology and business functions. Chair or co-chair ACE's cybersecurity and technology risk governance process as designated by the CIO. • Maintain the enterprise cybersecurity risk register and associated remediation portfolio. Translate technical findings into institutional, financial, operational, regulatory, and reputational exposure, with prioritized treatment recommendations and accountable due dates. • Direct security operations and incident readiness, including threat monitoring, vulnerability management, identity protection, endpoint and cloud security, incident response, digital forensics coordination, post-incident reviews, and oversight of managed security service providers. • Serve as executive incident commander for material cybersecurity events, with authority under approved response plans to activate external partners, isolate systems, suspend affected services, preserve evidence, and coordinate decisions with the CIO, Legal, Privacy, Communications, cyber insurance, and executive leadership. • Lead enterprise infrastructure and cloud strategy across Microsoft 365, Azure, Entra ID, networks, endpoints, collaboration platforms, backup, recovery, monitoring, and end-user technology. Ensure architecture is secure, scalable, supportable, resilient, and economically sustainable. • Establish enterprise security architecture principles and security-by-design requirements for technology acquisitions, contracts, system implementations, application development, integrations, cloud services, system changes, and artificial intelligence solutions. • Partner with ACE's AI governance leadership to define risk-tiering, authorization, data protection, audit, monitoring, data loss prevention, and exception requirements for AI-enabled services. • Own ACE's enterprise technology resilience strategy, integrating business continuity, disaster recovery, cyber recovery, crisis management, infrastructure availability, identity recovery, vendor continuity, and recovery testing. • Establish recovery time and recovery point objectives with business owners, maintain immutable or isolated recovery capabilities where appropriate, conduct annual executive tabletop and critical-service recovery exercises, and report readiness gaps and remediation progress. • Ensure security and infrastructure practices support applicable higher-education, privacy, contractual, and payment-card obligations, including FERPA, the GLBA Safeguards Rule, PCI DSS, cyber insurance requirements, and applicable state privacy and breach-notification laws, in partnership with Legal and Compliance. • Sponsor independent security assessments, penetration tests, control audits, program-maturity reviews, and executive exercises. Own management responses, remediation commitments, and defensible evidence of policy adoption, control testing, exceptions, and corrective action. • Own infrastructure and security vendor strategy, due diligence, contracts, service levels, performance, continuity, and risk. Rationalize tools and services to improve coverage, accountability, and total cost of ownership. • Develop and manage operating and capital budgets, workforce plans, sourcing strategies, and multi-year investment business cases that quantify risk reduction, service improvement, cost avoidance, and total cost of ownership. • Set and report executive performance measures for material risk, control effectiveness, availability, vulnerability remediation, incident response, recovery readiness, third-party risk, vendor performance, employee experience, and program maturity. • Recruit, lead, coach, and retain high-performing infrastructure and security teams. Clarify accountability across strategy, governance, engineering, operations, service delivery, and external partners. • Maintain current knowledge of cyber threats, regulatory expectations, cloud and infrastructure practices, and emerging technologies. Recommend timely changes to strategy, architecture, policy, controls, and investment priorities. Qualifications and Education Requirements • Bachelor's degree in information technology, cybersecurity, computer science, business, or a related discipline, or an equivalent combination of education and relevant executive experience. • 15+ years of progressive technology and cybersecurity leadership experience, including at least 7 years leading enterprise infrastructure, cybersecurity, risk, or resilience functions and accountability for managers, senior technical professionals, and strategic service providers. • Demonstrated success serving as a Vice President, Deputy Chief Information Security Officer, senior security executive, or technology executive with equivalent enterprise accountability for cybersecurity strategy, infrastructure, governance, risk, and resilience. • Demonstrated experience developing and executing multi-year cybersecurity and infrastructure strategies, roadmaps, policies, standards, governance models, and investment plans with measurable business and risk outcomes. • Deep working knowledge of NIST Cybersecurity Framework 2.0 and related security and control practices, with experience translating risk assessments and maturity evaluations into funded remediation portfolios. • Demonstrated ownership of enterprise security policies, control frameworks, risk acceptance, exception governance, regulatory assurance, audit remediation, and executive or Board-level risk reporting. • Experience directing material cybersecurity incident response or enterprise crisis exercises, including coordination with executive leadership, legal counsel, cyber insurance, digital forensics providers, communications, and managed security services. • Strong experience with cloud-first and virtual-work environments, including Microsoft 365, Azure, Entra ID, Defender, Purview, Sentinel, Intune, networking, backup and recovery, monitoring, identity and access management, and service management, or comparable enterprise platforms. • Demonstrated leadership of security operations, vulnerability management, data protection, third-party risk, security architecture, business continuity, disaster recovery, cyber recovery, and security awareness capabilities. • Experience applying regulatory and contractual requirements relevant to higher education and digital operations, including FERPA, the GLBA Safeguards Rule, PCI DSS, privacy obligations, cyber insurance requirements, and breach-response requirements. • Proven ability to communicate complex technology risk, incidents, investment priorities, and performance to the CIO, executive leadership, and governance bodies in clear business terms. • Strong financial and commercial management skills, including budget ownership, business-case development, contract negotiation, vendor governance, service-level management, workforce planning, and technology cost optimization. • Demonstrated ability to lead organizational change, establish institutional accountability, develop talent, and operate effectively across a distributed, virtual-first organization. • CISSP or CISM certification required. CRISC, CCSP, CGEIT, ITIL 4, or relevant Microsoft cloud and security certifications are preferred. Our Commitment to Employees Just as we strive to empower our students for success, we also aim to enrich the lives of our employees. For 6 consecutive years, ACE was recognized as one of Indiana's Best Places to Work, winning the #1 spot for medium-sized companies in 2020. In addition, ACE has earned national recognition, being named a USA Top Workplace in 2022, 2023 and 2024. As a virtual first organization, we celebrate diversity and are committed to creating a family-like inclusive work environment. For our full-time employees, we offer the following benefits: • Medical, dental, & vision Insurance • HSA and FSA options • Paid parental leave • Paid volunteer time • Tuition reimbursement & reduction programs • Generous PTO • 401k and employer match • Full-service wellness and EAP program • Employee recognition and awards programs • Employer paid life & AD&D insurance • Short-term disability • Employer paid long-term disability • And more... Physical Demands The physical demand described here are representative of those that must be met by an employee to successfully