Virtual CISO (vCISO) / Cybersecurity Program Lead
Abacus Service Corporation· Oct 12, 2026 · 15d ago
Rock Springs, WY
In office
Full-time
Lead
$134K–$206K est.
Job description
Job Title
Virtual CISO (vCISO) / Cybersecurity Program Lead
Client Company/Dept. Name
Western Wyoming Community College
Address
2500 College Drive, E-460
City Name
Rock Springs
State Name
WY-Wyoming
Zip Code
82901
If others (Address)
Duration of the project
Project Start Date
Nov. 13, 2026
Project End Date
3-year initial term, with renewal options
Due date for Resume submission
10/15/2026
No. of Openings
1
No. of Maximum Submissions
1
Job Description
Role summary: WWC has an information security analyst but no designated CISO (Addendum 1). The vCISO owns WWC's cybersecurity program end to end: strategy, NIST-aligned controls, risk, policy and incident readiness. They lead the SOC, engineering and GRC leads and mentor WWC's security analyst.
Reports to: Fractional CIO (integrated governance model permitted when CIO and cybersecurity are awarded together, per Addendum 1)
Direct reports: SOC & IR Lead, Security Engineering Lead, GRC & Compliance Lead; dotted line to WWC's information security analyst
Location: US-based; remote, with quarterly onsite visits and onsite presence during major incidents if needed
Allocation: 0.3–0.4 FTE; 24/7 on-call escalation for critical incidents
Key responsibilities:
• Lead the cybersecurity Discovery & Assessment: a security posture baseline, NIST CSF 2.0 maturity scoring, and a review of existing tools and prior assessments (shared with the vendor after award).
• Produce the cybersecurity 90-day plan and a 3-year security roadmap.
• Recommend and govern the security monitoring model (24/7 SOC/MDR), using the Microsoft 365 A5 security stack (Defender XDR, Sentinel, Entra ID P2, Purview) where it makes sense.
• Own risk assessment and mitigation planning; maintain the cyber risk register; deliver the annual cybersecurity risk report to WWC leadership.
• Develop and approve cybersecurity policies (information security, acceptable use, access control, incident response, data classification, vendor risk).
• Own incident response planning and serve as incident commander for major incidents; coordinate with WWC leadership, legal counsel, cyber insurance carrier and law enforcement.
• Oversee the GLBA Safeguards Rule information security program, FERPA safeguards and regulatory compliance support.
• Run the security awareness strategy for faculty, staff and administration (about 510 users).
• Advise on DR/BC strategy, cloud security and third-party/vendor security risk.
• Present cybersecurity posture to the CIO, cabinet and Board.
Deliverables owned: security assessment reports, the cybersecurity 90-day plan, the annual cybersecurity risk report, cybersecurity policy set, the incident response plan (with SOC & IR Lead), and quarterly security posture reports.
Skill set info
Experience: 15+ years in information security, including 7+ years as CISO, vCISO or security program leader
Required qualifications:
• 15+ years in cybersecurity, including 7+ years leading security programs as CISO or vCISO; higher education experience strongly preferred.
• Deep expertise in NIST CSF 2.0 and NIST SP 800-53/800-171, plus FERPA, GLBA Safeguards Rule (16 CFR 314) and PCI DSS.
• Has built or matured security programs in Microsoft 365 / Azure environments.
• Has led real incident response engagements, including ransomware and business email compromise.
• Strong executive and board communication.
• Bachelor's degree in Cybersecurity, IT or Computer Science; Master's preferred.
Preferred: vCISO experience with colleges or universities; experience with the higher-education information sharing center (REN-ISAC) and the EDUCAUSE HECVAT security questionnaire.
Education
Bachelor's degree in Cybersecurity, IT or Computer Science; Master's preferred.
Certifications (if required)
Certifications (required: at least one of): CISSP, CISM. Preferred: CISA, CRISC, CCISO, GIAC GSLC or GSTRT.
Documentation Required for submission
Updated Resume
Work Hours
0.3–0.4 FTE; 24/7 on-call escalation for critical incidents
Account Manager Name (Proposal Team)
Work authorization required
USC/GC/EAD/H1 also
Relocation is accepted
No
Remote work
Yes, remote is fine. Quarterly onsite visits and onsite presence during major incidents if needed
Additional Notes if any
Candidate can be based anywhere in the US. Being located in or near Rock Springs, Wyoming is a preference only, not a requirement. Quarterly onsite visits, and onsite presence during major incidents if needed.
By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at Privacy Policy - Abacus .
Application prep
Use the role’s language and application details while tailoring your materials.
Keywords to mirror
azureai
- Platform
- jobdiva
- Effort
- medium