Chief Information Security Officer

Chief Information Security Officer (0933 Manager V) - Department of Public Health Job Type: Full-time Certification Rule: Rule of the List Exam Type: Position Based Test Work Hours: Regular Job Code and Title: 0933-Manager V Fill Type: Permanent Civil Service Eligible List Type: Combined Promotive and Entrance Application Opening: Friday, November 21, 2025Application Deadline: Friday, December 19, 2025 The Department of Public Health prioritizes equitable and inclusive access to quality healthcare for its community and values the importance of diversity in its workforce. All employees at the Department of Public Health work to advance equity, inclusion, and diversity with a specific lens and focus on race, ethnicity, gender, sex, sexuality, disability, and immigration status. Becoming a City employee means being a part of a team that cares about making a difference. Your work will shape both the present and future of San Francisco. When you work for the City, youre choosing a job with purpose. The mission of the San Francisco Department of Public Health (SFDPH) is to protect and promote the health of all San Franciscans. SFDPH strives to achieve its mission through the work of several divisions - the San Francisco Health Network, Population Health Division, Behavioral Health Services, and Central Administration. The San Francisco Health Network is the Citys only complete system of care and has locations throughout the City, including Zuckerberg San Francisco General Hospital and Trauma Center, Laguna Honda Hospital and Rehabilitation Center, and over 15 primary care health centers. The Population Health Division (PHD) provides core public health services for the City and County of San Francisco: health protection, health promotion, disease and injury prevention, disease surveillance, and disaster preparedness and response. Behavioral Health Services operates in conjunction with SFHN and provides a range of mental health and substance use treatment services. Central Administration houses core support organizations, including Finance, Information Technology (IT), Human Resources, Privacy and Compliance, Business Office, Facilities Management, and Security Services. The San Francisco Department of Public Health is seeking a dynamic and experienced cybersecurity professional to join its IT leadership team. As a key strategic leader, the Chief Information Security Officer (CISO) (0933 Manager V) will be responsible for developing and executing a comprehensive information security strategy that safeguards the departments systems, data, and services. This role leads the implementation of an enterprise-wide security program that promotes collaboration, strengthens governance, and aligns cybersecurity initiatives with organizational goals. The CISO serves as a trusted advisor to senior leadership, providing expert guidance on risk management, security investments, and policy development. The CISO oversees a team of cybersecurity professionals within the SFDPH IT division and collaborates extensively with the CISO for the City and County of San Francisco. We are looking for a visionary and collaborative leader who can balance innovation with risk mitigation, and who thrives in a complex, mission-driven environment. The CISO reports directly to the Chief Information Officer (CIO). Essential Job Functions Provides strategic leadership in evaluating and mitigating information security threats across the organization using a structured, risk-based methodology. Advises executive leadership on identified risks and ensures timely execution of mitigation and remediation plans with integrity and discretion. Directs the ongoing development of the departments information security program, including project portfolio management, incident response, policy frameworks, compliance activities, threat and vulnerability management, and thirdparty risk management. Allocates and manages resources to support a robust security strategy. Identifies and advocates for strategic investments, oversees capital and operating budgets, and delivers ROI analyses and budget recommendations. Partners with the Office of Compliance and Privacy Affairs to assess data security risks related to contracts, projects, artificial intelligence solutions, and other initiatives. Develops tools and interventions to mitigate risks, establishes performance metrics, and monitors compliance through audits and assessments. Builds alignment and support for security goals and initiatives across internal and external stakeholders. Communicates effectively with leadership at all levels on trends, risks, and the overall effectiveness of the security program. Promotes awareness and understanding of regulatory requirements across the organization. Leads or collaborates on testing and auditing activities to ensure ongoing compliance and successful certifications. Analyzes security requirements and ensures compliance with industry standards such as HIPAA, NIST, and PCIDSS. Establishes and maintains comprehensive policies and procedures to support effective and sustainable security operations. Serves as the departments representative in securityrelated matters with City agencies and partners. Continuously monitors emerging trends, technologies, and best practices in cybersecurity to ensure the departments security posture remains current and effective. The Chief Information Security Officer (0933 Manager V) may perform other duties as assigned or required. Major Qualifications Education: A bachelors degree from an accredited college or university. (Education substitution: Additional experience may be substituted for the required degree on a yearforyear basis. One year is equivalent to thirty semester units or fortyfive quarter units.) Experience: Five (5) years of professional healthcare information systems security experience, of which three (3) years must include supervising IT professionals. Applicants must meet the minimum qualification requirements by the final filing date unless otherwise noted. Oneyear fulltime employment is equivalent to 2,000 hours (2,000 hours of qualifying work experience is based on a 40hour work week). Desirable Qualifications Possession of a Certified Information Systems Security Professional (CISSP) and/or Certified Information Security Manager (CISM) certification. Verification of Education and Experience Every application is reviewed to ensure that you meet the minimum qualifications as listed in the job ad. Review SF Careers Employment Applications for considerations taken when reviewing applications. Applicants may be required to submit verification of qualifying education and experience at any point during the recruitment and selection process. Note: Falsifying ones education, training, or work experience or attempted deception on the application may result in disqualification for this and future job opportunities with the City and County of San Francisco. Selection Procedures After application submission, candidates deemed qualified must complete all subsequent steps to advance in this selection process, which includes the following: Supplemental Questionnaire (SQ) Examination (Weight: 100%) Candidates that meet the minimum qualifications will be invited to participate in a Supplemental Questionnaire (SQ) examination that is designed to measure the knowledge, skills, and abilities in jobrelated areas. Candidates must achieve a passing score on the Supplemental Questionnaire exam in order to continue in the selection process. Additional selection processes may be conducted by the hiring department prior to making final hiring decisions. Certification The certification rule for the eligible list resulting from this examination will be the Rule of the List. Terms of Announcement and Appeal Rights Applicants must be guided solely by the provisions of this announcement, except when superseded by federal, state or local laws, rules, or regulations. Applicants may appeal under Civil Service Rule 111A.35.1 within five business days of the announcement issuance date. Where to Apply All job applications for the City and County of San Francisco must be submitted through our online portal at Applicants may be contacted by email about this recruitment. Please use a personal email address that you check regularly rather than a work or school account. Contact Information If you have any questions regarding this recruitment or application process, please contact the analyst, Marielle Saldajeno at marielle.saldajeno@sfdph.org or (628) 271-6820. We may use text messaging to communicate with you on the phone number provided in your application. The first message will ask you to opt in to text messaging. Equal Opportunity Employment The City and County of San Francisco encourages women, minorities and persons with disabilities to apply. Applicants will be considered regardless of their sex, race, age, religion, color, national origin, ancestry, physical disability, mental disability, medical condition associated with cancer, a history of cancer, or genetic characteristics, HIV/AIDS status, genetic information, marital status, sexual orientation, gender, gender identity, gender expression, military and veteran status, or other protected category under the law. #J-18808-Ljbffr