Deputy Chief Information Security Officer

Together We Innovate. Together We Change.

Looking for a role where you can lead high performing teams within an IT Risk Management organization, for a Fortune 200 Company? If you have a bachelor’s degree along with 10 plus years of experience as a Deputy Chief Information Security Officer, BISO, or lead over a significant portion of an information security program, we want to speak with you! We are currently seeking a Deputy Chief Information Security Officer (CISO) to join our IT Risk Management group in Richmond, VA.  While the preferred location for this position is Richmond, VA, it is not a requirement; however, the role does require flexibility to travel to Richmond as needed.

The Deputy CISO serves as a strategic and operational leader within the Information Technology Risk Management (ITRM) organization. This role is responsible for leading the Security Architecture and Engineering functions, overseeing security-related project delivery, and managing the Business Information Security Officer (BISO) program. The Deputy CISO ensures alignment between enterprise security objectives and business initiatives, enabling scalable, resilient, and compliant security operations.

As the Deputy CISO, you will provide information security guidance to business partners across the organization by advising and recommending information security investments and actions which mitigate risks, strengthen defenses, and reduce vulnerabilities for development, internal and client facing systems and products. Additionally, as required, the Deputy CISO acts in the capacity and on the behalf of Altria’s CISO.

Job Responsibilities

What you will be doing:

Solutions Architecture & Engineering:

• Developing an information security strategy that is aligned to organizational priorities that enables and facilitates the organization's business objectives.
• Lead the design, implementation, and continuous improvement of enterprise security architecture and controls.
• Partner with enterprise architects and control owners to align security standards with business and regulatory requirements (e.g., SOX, PCI, HIPAA, AI, PII).

Delivery of Security Capabilities

• Leading the planning and prioritization for the remediation of technical IT Risk deficiencies while providing guidance and reasonable IT risks to accept. Providing clear risk mitigating directives for projects with components in IT, including the mandatory application of controls
• Manage and support escalations for security-related project portfolios, ensuring timely delivery and risk mitigation.

BISO Team Alignment

• Lead and mentor BISOs who enable business units to ensure consistent risk identification, escalation, and remediation. Support BISOs in driving business-led risk reduction efforts and policy adherence.
• Defining and implementing enterprise security and risk policy, developing cybersecurity technology standards, implementing global controls and monitoring/reporting of performance of those controls.
• Acting as a champion in growing Altria’s culture of cybersecurity

Specific Skills

We want you to have:

• Bachelor’s degree; Masters preferred (in IT, Security or Business)
• 15+ years of broad Information Security / Information Technology background in large scale enterprise environments
• 10+ years of experience as a Deputy CISO, BISO or lead over a significant portion of an information security program, preferably in a heavily regulated industry
• Demonstrated set of diverse experiences and success in senior leadership roles in risk management, information security, and IT or OT security, information technology etc.
• Excellent written and verbal communication skills, with the ability to message complex security topics to various audiences; specific experience with working with the board of directors preferred
• Experience leading multi-functional teams of 10 or more; Ability to lead and motivate the information security team to achieve tactical and strategic goals, even when only "dotted line" reporting lines exist
• Knowledge and experience of managing information security across multiple geographic locations, including international locations
• Demonstrated experience managing multimillion-dollar projects across a broad geographical footprint
• One or more relevant certifications including:
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified in Risk and Information Systems Control (CRISC)

Compensation and Benefits

Additional Information