Associate Director of Information Security, Cybersecurity and Risk

Job Function:

The Associate Director, Information Security, Cybersecurity & Risk plays a critical role in safeguarding the NCAA’s digital assets and ensuring the integrity, confidentiality, and availability of information systems that support our mission in collegiate athletics.

The NCAA Associate Director, Information Security is responsible for the development, implementation, training and oversight of the NCAA Information Security Program and supporting policies, standards, processes, procedures and related NCAA projects in support of organization objectives.

Job Description:

• Developing and implementing an overall information security program to enable and monitor appropriate controls to mitigate threats and risk to the NCAA's information.


• Conducting risk assessments and defining mitigation measures.


• Create, implement, and maintain security policies, standards, and procedures


• Ensuring the organization is in compliance with the regulatory requirements related to information security (e.g., GDPR, HIPAA, ISO 27001).


• Assisting the NCAA's legal affairs department in ensuring the NCAA is in compliance with regulatory requirements related to data privacy.


• Maintaining relationships with local, state and federal law enforcement and other related government agencies, as needed, to collaborate on information security initiatives.


• Overseeing incident response planning as well as the investigation of security breaches and assisting with disciplinary and legal matters associated with such breaches.


• Implementing and facilitating regular staff training sessions on information security awareness and procedures.


• Managing day-to-day information security operations.


• Conduct regular audits and risk assessments.


• Identify potential security risks and vulnerabilities.


• Keeping up to date with the risk environment and mitigation strategies for consideration in protecting NCAA information.


• Educate employees on security best practices and leaded Cybersecurity annual training efforts


• Conduct phishing simulations and awareness campaigns


• Lead NCAA vendor and third-party risk management by assessing the security posture of vendors and partners and ensuring all contractual agreements include appropriate security requirements.


• Oversee PCI Compliance of the NCAA.


• Oversee the Record Retention and Destruction policy of the NCAA.


• Oversee the annual Penetration and Vulnerability Testing of the NCAA network.


• Maintain and oversee the NCAA IT Disaster Recovery Program and Business Continuity Program.

Job Requirements:

• Bachelors degree in computer science, information security, or related field required. Master's degree preferred.


• Minimum of five years of information systems and security experience and four years information security management experience preferred.


• CISM or CISSP current certification; preferably both.


• Demonstrated experience in the following areas: risk analysis, incident response, business continuity, disaster recovery, vendor management, regulatory compliance.


• Knowledge and experience working with: application development, technology solutions select, acquisition, implementation and support, system administration, network operations, technical security, and business process.


• Broad knowledge in computer information and networking systems.


• Ability to evaluate current and emerging technology trends to formulate enterprise recommendations.


• Advanced skills and knowledge in systems which affect the design and implementation of enterprise programs and or processes.


• Understanding cloud infrastructure and application architectures, topologies, practices and technologies.


• Estimated travel required: <10%


• The Associate Director of Information Technology, Cybersecurity and Risk will report to the Director of Planning & Governance with dotted line to Director of Infrastructure and Operations.


• This position will be based out of the national office in Indianapolis, Indiana. Current work environment is hybrid; 2 days in the office and 3 days are remote.

Job Competencies:

• Self-Management | Takes responsibility of one's behavior, work, priorities, and time management accordingly.


• Project Management | The discipline of planning, organizing, and managing resources to bring about the successful completion of a specific project.


• Problem Solving | Identifies and analyzes problems; weighs relevance and accuracy of information; generates and evaluates alternative solutions; makes recommendations.


• Strategic Agility | Sees ahead clearly, can anticipate future consequences ad trends accurately, has broad knowledge and perspective, is future oriented, can articulately paint credibly pictures and visions of possibilities and likelihoods, can create competitive and breakthrough strategies and plans.


• Critical Thinking | Ability to examine issues and ideas and to identify good and bad reasoning in a variety of fields with differing assumptions, contents, and methods.

Core Values:

• LEADERSHIP| We actively listen and continually strive to provide vital solutions, counsel and advocacy for student-athletes and intercollegiate athletics.


• INCLUSION| We seek and incorporate different perspectives and experiences to drive innovation and impact.


• COMMUNICATION| We commit to an environment of openness to build trust and make timely decisions.


• COLLABORATION| We work together, based on mutual respect, to lead and serve our stakeholders.


• ACCOUNTABILITY | We take ownership for our actions and results to add value every day.