Director of Security Assurance.
Cybersecurity Policy and Standards
Drafts and maintains enforceable standards, procedures, and guidelines that reflect Dartmouth’s shared governance environment and distributed operational model.
Manages the full policy lifecycle, including drafting, stakeholder consultation, governance review and approval, publication, version control, exception management, and periodic review.
Translates regulatory and contractual obligations, including FERPA, GLBA Safeguards Rule, HIPAA, NIST SP 800-171 and CMMC, ITAR and EAR, PCI DSS, and NH RSA 359-C:20, into clear, actionable institutional requirements.
Risk Management
Designs, implements, and continuously improves the formal cybersecurity risk management program, including risk identification, assessment methodology, scoring, treatment planning, risk acceptance, and exception workflows.
Leads and facilitates risk assessments across institutional systems, research computing environments, cloud platforms, and third-party integrations.
Maintains an enterprise cybersecurity risk register and presents risk posture and trends to the CISO and senior leadership, translating technical findings into institutional, financial, and mission impact for non-technical audiences, including the Board of Trustees.
Third Party Risk Management
Develops and oversees a comprehensive third-party risk management program, including intake workflows, vendor tiering, security assessment criteria, and ongoing monitoring.
Evaluates vendors, SaaS providers, cloud services, and research collaborators for alignment with institutional security standards and regulatory requirements.
PARTNERS WITH PROCUREMENT, THE OFFICE OF GENERAL COUNSEL, AND RESEARCH ADMINISTRATION TO INTEGRATE SECURITY REVIEW INTO CONTRACTING, VENDOR ONBOARDING, AND RESEARCH PARTNER PROCESS.
MONITORS AND REPORTS ON AGGREGATE THIRD PARTY RISK EXPOSURE AND PRIORITIZES MITIGATION BASED ON RISK SEVERITY AND CONCENTRATION.
Cybersecurity Education and Awareness
Designs and leads a comprehensive cybersecurity awareness and training program tailored to faculty, staff, students, and researchers, recognizing distinct risk profiles and operational realities.
Develops role based training curricula for high risk populations, including system administrators and personnel handling regulated or controlled unclassified information.
OVERSEES PHISHING SIMULATIONS, TABLETOP EXERCISES, AND TARGETED AWARENESS INITIATIVES ALIGNED WITH CURRENT THREAT TRENDS AND INSTITUTIONAL RISK PRIORITIES.
ESTABLISHES AND TRACKS METRICS TO EVALUATE BEHAVIORAL CHANGE, TRAINING EFFECTIVENESS, AND RISK REDUCTION.
Cybersecurity Metrics and Reporting
Defines and maintains key performance and risk indicators that inform decision making at the CISO, CIO, executive leadership, and Board levels.
Develops dashboards and recurring reports that communicate program maturity, compliance posture, risk exposure, and operational effectiveness in clear, accessible language.
BENCHMARKS INSTITUTIONAL CYBERSECURITY CAPABILITIES AGAINST HIGHER EDUCATION PEERS USING AVAILABLE EDUCAUSE, REN-ISAC, AND IVY PLUS COHORT DATA.
Compliance and Audit Support
Serves as the primary information security liaison for internal and external audits, compliance reviews, and regulatory inquiries.
OVERSEES CONTROL MAPPING, EVIDENCE COLLECTION, GAP ASSESSMENTS, AND REMEDIATION TRACKING ACROSS APPLICABLE REGULATORY FRAMEWORKS.
PARTNERS WITH RESEARCH ADMINISTRATION TO SUPPORT COMPLIANCE REQUIREMENTS FOR FEDERALLY FUNDED AND EXPORT CONTROLLED RESEARCH, INCLUDING NIST SP 800-171, CMMC, AND ITAR AND EAR.
MaintAINS AUDIT READY DOCUMENTATION AND ENSURES CORRECTIVE ACTIONS ARE TRACKED THROUGH COMPLETION.