Chief Information Security Officer

Job Location: Corporate Indianapolis Simon Property Group is seeking a strategic, business-focused CISO to lead the company’s enterprise cybersecurity, cyber-risk, and data privacy program, safeguarding the systems, data, digital platforms, and property operations critical to our business. This position reports to the Chief Technology Officer, has direct access to the Audit Committee, and is based at our corporate headquarters in Indianapolis. Principal Responsibilities Set and execute a multi-year, risk-based security strategy and report on cyber risk to the executive team, Audit Committee and BoardLead secure AI and GenAI adoption, including AI governance, agentic AI and non-human identity controls, and using AI to strengthen our defensesProtect corporate systems, property operational technology, and the shopper- and tenant-facing platforms that serve millions of peopleLead data privacy controls for Simon+ and other shopper platforms and partner with Legal on privacy mattersDirect 24x7 security operations and incident response, lead incident materiality assessment and support SEC cyber disclosure, and support PCI DSS and SOX complianceLead third-party and vendor risk management and resilience, including business continuity, disaster recovery, and ransomware recoveryPartner with Physical Security, Legal, Finance, Property Operations, Internal Audit, Enterprise Risk, and Digital to align security with the businessBuild a high-performing team and a security culture that changes everyday behavior Minimum Qualifications 15+ years in IT and security, including 7+ years in senior security leadershipExperience building an enterprise security program in a large, multi-site organizationExperience presenting cyber risk to a BoardHands-on leadership through significant security incidentsExperience securing operational technology/IoT and cloud environmentsKnowledge of securing GenAI, NIST CSF, ISO 27001, and PCI DSSPublic company, REIT, retail, or hospitality experience preferred; CISSP, CISM, CISA, or CRISC a plus Executive presence, sound judgment under pressure, and a pragmatic, business-enabling approach matter as much as technical depth.