Chief Information Security Officer

We are looking for an experienced Chief Information Security Officer to provide strategic technology and security leadership for a mission-driven nonprofit in Boston, Massachusetts. This Long-term Contract opportunity is ideal for a senior leader who can evaluate current risk exposure, strengthen protection of sensitive donor and client information, and shape a practical roadmap for cybersecurity, data governance, and resilience. The position combines executive-level advisory work with hands-on involvement in infrastructure, disaster recovery planning, and security operations in a Microsoft 365 and Azure-based environment.

Responsibilities:

• Develop a comprehensive security and IT risk strategy aligned with the organization’s mission, operational needs, and compliance expectations.
• Assess the current technology landscape and produce a prioritized roadmap covering cybersecurity improvements, data governance, business continuity, and disaster recovery readiness.
• Lead gap analyses focused on data protection, incident response, network security, backup practices, and overall resilience against breaches or service disruptions.
• Establish and refine policies for information handling, document classification, retention, and archiving to better safeguard confidential legal, community, and donor records.
• Partner with leadership, the internal IT manager, and external service providers to strengthen day-to-day security operations and improve oversight of help desk and technology vendors.
• Provide senior guidance on protecting cloud and on-premises systems, including Microsoft 365, Azure services, shared file environments, servers, and network infrastructure.
• Support planning and execution for critical technology upgrades and security enhancements while minimizing operational risk to the organization.
• Advise on incident preparedness by defining response procedures, escalation paths, and recovery approaches for cyber threats, system outages, and data integrity events.
• Deliver practical recommendations to executive stakeholders on technology priorities, risk posture, and investments needed to support long-term organizational stability.
• 10+ years of experience leading information security, technology risk, or enterprise IT strategy initiatives in complex environments.
• Proven success building cybersecurity programs, risk management frameworks, and recovery strategies that protect sensitive and confidential information.
• Strong background in IT strategy, executive leadership, and development of business, application, engineering, or capability roadmaps.
• Hands-on knowledge of cloud and infrastructure environments, including Microsoft 365, Azure, backup systems, disaster recovery processes, and server administration.
• Experience conducting risk assessments across security, operations, vendors, and data management practices, with the ability to turn findings into actionable plans.
• Familiarity with network and perimeter security concepts, including firewall technologies such as Cisco ASA, and broader security controls.
• Ability to work effectively with internal teams, external vendors, and executive stakeholders in a values-driven organization with a fast-moving environment.
• Excellent communication and advisory skills, with the ability to balance strategic planning and hands-on execution in a fractional leadership capacity.