vCISO/Cyber Security Principal

Key Responsibilities

Client Executive Advisory and Engagement Leadership 

• Serve as the primary trusted cybersecurity advisor to client executives, leadership teams, and boards for assigned accounts. 

• Establish engagement objectives, governance, decision rights, meeting cadence, success measures, and executive reporting expectations. 

• Translate technical findings, threat conditions, and compliance obligations into business impact, clear choices, and prioritized actions. 

• Build durable client relationships through proactive communication, sound judgment, transparency, and follow-through. 

• Manage multiple client programs while maintaining quality, consistency, and responsiveness. 

Cybersecurity Strategy, Governance, and Maturation 

• Assess current-state program maturity and define target-state capabilities using the framework most appropriate to each client. 

• Develop and maintain multi-year cybersecurity maturation roadmaps aligned to business strategy, budgets, risk tolerance, and regulatory requirements. 

• Create or improve governance structures, policies, standards, risk registers, performance measures, and reporting mechanisms. 

• Guide security budgeting, investment prioritization, and risk-treatment decisions. 

• Define meaningful key risk and performance indicators and use them to demonstrate progress and support executive decisions. 

Risk, Compliance, Resilience, and Third-Party Oversight 

• Lead or guide cybersecurity risk assessments, gap assessments, and remediation planning. 

• Advise clients on alignment with NIST CSF, NIST 800-53/171, CIS Controls, ISO 27001, CMMC, PCI DSS, HIPAA, and SOC 2, as applicable. 

• Support audit and assessment readiness without representing Tusker as the independent auditor or attestation body. 

• Lead third-party risk discussions, vendor due diligence, and risk-based review of critical service providers. 

• Develop, review, and exercise incident response and cyber resilience plans, including executive and board-level tabletop exercises. 

• Advise on the secure adoption of cloud, AI, and emerging technologies. 

Tusker Delivery and Growth Collaboration 

• Coordinate with Tusker Solution Architects, technical delivery teams, Managed Services, Advisory, Sales, and external partners to translate roadmaps into executable work. 

• Clarify ownership, dependencies, timing, and expected outcomes across strategic and technical workstreams. 

• Provide cybersecurity subject-matter expertise during qualified sales pursuits, client workshops, renewals, and expansion discussions. 

• Help shape repeatable vCISO methods, templates, reporting, service standards, and quality controls. 

• Mentor colleagues and strengthen the ability of Tusker teams to identify advisory needs and engage the right resources. 

Required Qualifications

• 12 or more years of progressive cybersecurity experience, including significant responsibility for cybersecurity strategy, governance, risk, compliance, and program leadership. 

• Experience serving as a CISO, vCISO, deputy CISO, security executive, or equivalent senior cybersecurity leader. 

• Demonstrated ownership of cybersecurity programs, budgets, risk decisions, executive reporting, and board-level communication. 

• Proven ability to lead strategic assessments, create multi-year roadmaps, and guide security-program maturation. 

• Strong working knowledge of NIST CSF, NIST 800-53/171, CIS Controls, ISO 27001, CMMC, PCI DSS, HIPAA, and SOC 2. 

• Experience leading incident response planning, executive exercises, third-party risk activities, and governance or policy programs. 

• Executive-level communication, facilitation, writing, and presentation skills, with the ability to communicate clearly to technical and non-technical audiences. 

• Ability to lead through influence across client teams, Tusker teams, and external providers. 

• Ability to manage multiple concurrent client engagements and operate effectively in ambiguous situations. 

• High ethical standards, discretion, and professional integrity. 

• Candidate should reside within approximately two hours driving distance of Chicago and be able to travel periodically based on client and business needs. 

Preferred Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Business, or a related field; advanced degree is a plus. 

• One or more relevant certifications, including CISSP, CISM, CRISC, CISA, CDPSE, or CIPP. 

• Experience delivering vCISO, cybersecurity advisory, consulting, MSP, or MSSP services to mid-market clients. 

• Experience in regulated industries such as healthcare, financial services, manufacturing, education, public sector, or organizations in the defense industrial base. 

• Familiarity with GRC platforms, compliance automation, common security operations capabilities, and the commercial realities of outsourced service delivery.