Chief Information Security Officer (CISO)

The Position

Reporting to the Chief Information Officer (CIO), the Chief Information Security Officer (CISO) serves as the executive leader responsible for shaping and overseeing the institution’s cybersecurity strategy and operations, ensuring the protection of critical digital assets and mitigating associated, ever-evolving cyber risks. This role is critical in protecting OIST’s academic, research, and administrative digital assets, ensuring the confidentiality, integrity, and availability of institutional data.

The CISO will,

• Oversee the institution’s cybersecurity program and operations.
• Be accountable for the development and management of cybersecurity infrastructure, covering device and network security, data protection frameworks, incident prevention/response protocols, and threat intelligence mechanisms.
• Implement and enforce risk mitigation measures across institutional systems.
• Ensure compliance with Japanese cybersecurity regulations and global best practices for academic institutions.
• Lead initiatives to enhance cybersecurity resilience against evolving threats.
• Cultivate a culture of security awareness, resilience, and continuous improvement.
• Any other relevant duties as assigned/designated by the CIO.

This role demands a strategic leader with deep technical expertise, strong leadership capabilities, and a thorough understanding of cybersecurity in higher education, research data protection, and Japan’s regulatory landscape.

Responsibilities

1. Cybersecurity Strategy & Leadership

• Partner with the CIO and executive leadership to develop and execute an information security strategy, embedding cybersecurity into institutional planning and governance.
• Define and track performance metrics (KPIs, SLAs, SLOs) to measure effectiveness and maturity.
• Lead maturity assessments and benchmark against global best practices.
• Lead and develop the information security team, fostering a high-performance and inclusive culture.

2. Governance, Compliance & Risk

• Establish and maintain security policies and standards aligned with institutional and regulatory requirements (e.g., NIST, ISO 27001, Japanese frameworks).
• Oversee compliance across vendors, research partners, and IT contracts (IaaS, PaaS, SaaS, SWAS).
• Collaborate with the Risk Manager and institutional committees to align cybersecurity with enterprise risk management.

3. Security Operations

• Oversee daily security operations and ensure protection of IT assets and data.
• Lead incident response, containment, and remediation efforts, reporting outcomes to the CIO and relevant committees.
• Implement monitoring systems and track threat detection KPIs.
• Guide secure architecture design and adoption of advanced technologies (e.g., IAM, DLP, encryption).
• Strengthen identity governance through RBAC, PAM, and MFA.

Qualifications

(Required)

1. Bachelor’s degree in Computer Science, Information Security, IT, or a related field.
2. 10+ years of progressive leadership in information security, IT risk management, or related domains.
3. 3+ years in a senior role—ideally as CISO or equivalent—with strategic oversight of enterprise security programs.
4. Demonstrated success in leading institution-wide security initiatives, including governance, risk, compliance, and incident response.
5. Experience in complex, regulated environments such as higher education, research institutions, non-profits, international organizations, or industries like finance, healthcare, and technology.
6. CISSP (Certified Information Systems Security Professional) or Chartered Cyber Security Professional.
7. Deep knowledge of industry frameworks (ISO 27001, NIST CSF, CIS Controls), Japanese data protection laws (APPI), and global compliance standards (GDPR, HIPAA).
8. Strong grasp of enterprise risk management, security architecture, and incident response planning.
9. Familiarity with academic environments, research data protection, and open-access systems.
10. Skilled in solving complex security challenges with a forward-looking, data-informed approach.
11. Excellent communicator in English; Japanese proficiency highly desirable for stakeholder engagement and regulatory alignment.

(Preferred)

1. Master’s or Ph.D. in Cybersecurity, Information Assurance, Business Administration, or a closely related discipline.
2. CISM (Certified Information Security Manager)
3. CISA (Certified Information Systems Auditor)
4. CCSP (Certified Cloud Security Professional)
5. CRISC, CEH, ISO 27001 Lead Implementer/Auditor

Compensation and Benefits

In accordance with the OIST Employee Compensation Regulations

Benefits:

• Relocation, housing and commuting allowances
• Annual paid leave and summer holidays
• Health insurance (Private School Mutual Aid)
• Welfare pension insurance (kousei-nenkin)
• Worker's accident compensation insurance (roudousha-saigai-hoshou-hoken)
• Access to Child Development Center
• Access to Schooling Options
• Language Education
• Resource Center (Daily Life Support in Okinawa)
• Remote Work System

Application Documents

• Curriculum vitae ideally in both Japanese and English

* Please be sure to indicate where you first saw the job advertisement.

Declaration

• OIST Graduate University is an equal opportunity, affirmative action educator and employer and is committed to increasing the diversity of its faculty, students and staff.
• Information provided by applicants or references will be kept confidential in accordance to the OIST Privacy Policy; documents will not be returned.
• Recruiting Organization: Okinawa Institute of Science and Technology School Corporation
• Prevention of Passive Smoking: No smoking indoors
• Please view our policy for rules on external professional activities: Rules for Concurrent Appointment.
• Further details about the University can be viewed on our website.