What are the responsibilities and job description for the Information Security Officer position at Commonwealth of Massachusetts - Department of Mental Health?
The Massachusetts Department of Mental Health (DMH) is looking for an Information Security Officer to join its team. The Information Security Officer (ISO) is the Department of Mental Health's senior agency-level official responsible for leading and coordinating the information security program and for ensuring that cybersecurity risks affecting DMH information, applications, technology-enabled services, and electronic protected health information (ePHI) are identified, assessed, communicated, and treated in a manner consistent with DMH mission needs, legal and regulatory obligations, Commonwealth requirements, and accepted risk-management practices.
The Information Security Officer provides independent security governance and risk oversight while working closely with DMH business and application owners, the Privacy and Data Access Officer, Compliance, General Counsel, Quality, facility leadership, EOHHS IT/Secretariat technology leadership, and EOTSS Cybersecurity and Enterprise Risk Management/Security Operations. The role is accountable for the effectiveness of the agency security management program; it is not expected to personally operate every technical security control that may be provided by EOHHS, EOTSS, application teams, infrastructure teams, vendors, or managed service providers.
Duties and Responsibilities (these duties are a general summary and not all inclusive):
- Lead and oversee the Department of Mental Health’s (DMH) agency-wide information security program, developing cybersecurity strategies, policies, procedures, and governance frameworks aligned with organizational priorities, regulatory requirements, and Commonwealth security standards.
- Direct enterprise cybersecurity risk management efforts by identifying, assessing, prioritizing, and communicating security vulnerabilities, compliance gaps, and emerging threats while recommending mitigation strategies and monitoring corrective actions.
- Provide strategic oversight of application, system, and data security to ensure the confidentiality, integrity, and availability of sensitive information, including electronic protected health information (ePHI), across technology platforms, cloud services, and data-sharing environments.
- Strengthen identity and access management practices by overseeing authentication protocols, access controls, privileged account management, and periodic security reviews to ensure appropriate authorization and protection of confidential information.
- Coordinate cybersecurity incident response and vulnerability management activities in collaboration with internal stakeholders, Commonwealth technology partners, and external service providers to support timely threat detection, incident resolution, and continuous security improvements.
- Advance business continuity, disaster recovery, and organizational resilience initiatives by evaluating critical technology dependencies, strengthening recovery strategies, and supporting preparedness efforts that minimize operational disruptions to essential behavioral health services.
- Oversee third-party cybersecurity risk and regulatory compliance by evaluating vendor security practices, establishing security requirements, and supporting audits, assessments, and accreditation activities in accordance with HIPAA, Commonwealth policies, and recognized industry standards.
- Collaborate with executive leadership, legal counsel, privacy officers, technology teams, and operational stakeholders to integrate cybersecurity considerations into organizational decision-making, technology modernization, procurement, and strategic initiatives.
- Promote a culture of cybersecurity awareness and accountability by providing expert guidance, supporting security education initiatives, and communicating emerging risks, security expectations, and best practices across the agency.
- Serve as a trusted cybersecurity advisor to senior leadership, delivering executive-level risk assessments, security performance reports, and strategic recommendations while exercising independent judgment to strengthen security governance, regulatory readiness, and the protection of DMH's critical information assets.
Preferred Qualifications:
- Extensive knowledge of information security governance, cybersecurity risk management, and enterprise security frameworks, including experience developing security policies, conducting risk assessments, evaluating internal controls, and implementing effective remediation strategies.
- Demonstrated knowledge of healthcare information security regulations, including the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and requirements for safeguarding electronic protected health information (ePHI) and other confidential data.
- Strong understanding of recognized cybersecurity frameworks and industry best practices, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, NIST risk management principles, CIS Controls, and secure system development practices.
- Experience implementing and evaluating identity and access management controls, including role-based access, multi-factor authentication, privileged access management, user authorization, and periodic access reviews.
- Comprehensive knowledge of cybersecurity technologies and security operations, including cloud security, network protection, encryption, vulnerability management, security monitoring, incident response, and threat mitigation.
- Demonstrated experience assessing security risks associated with enterprise applications, cloud-based platforms, third-party vendors, and data-sharing environments, with the ability to recommend practical solutions that support organizational and operational objectives.
- Experience supporting business continuity, disaster recovery, and cybersecurity incident response planning, including evaluating critical system dependencies, coordinating recovery activities, and strengthening organizational resilience.
- Familiarity with Commonwealth of Massachusetts information security policies, standards, and procedures, including those established by the Executive Office of Technology Services and Security (EOTSS), or the demonstrated ability to acquire this knowledge quickly.
- Excellent analytical, written, verbal communication, and interpersonal skills, with demonstrated ability to translate complex cybersecurity risks into actionable recommendations, advise executive leadership, and collaborate effectively with technical and nontechnical stakeholders.
- Proven leadership, strategic planning, and organizational management abilities, including experience managing competing priorities, establishing security performance measures, influencing cross-functional teams, and exercising independent judgment within a complex healthcare, government, or similarly regulated environment.
Department of Mental Health’s Mission:
The Department of Mental Health assures and provides access to services and support to meet the mental health needs of individuals of all ages, enabling them to live, work and participate in their communities. The Department establishes standards to ensure effective and culturally competent care to promote recovery. The Department sets policy, promotes self-determination, protects human rights and supports mental health training and research.
Pre-Offer Process:
A tax & background check will be completed on the recommended candidate as required by the regulations set forth by the Human Resources Division prior to the candidate being hired.
Education, licensure and certifications will be verified in accordance with the Human Resources Division's Hiring Guidelines.
Education and license/certification information provided by the selected candidate(s) is subject to the Massachusetts Public Record Law and may be published on the Commonwealth's website.
ADA Reasonable Accommodation:
If you require a reasonable accommodation with the application/interview process, please contact us at: EOHHS Candidate ADA Requests
https://www.mass.gov/reasonable-accommodations-for-executive-department-employees
For questions regarding this requisition, please contact the Executive Office of Health and Human Services Human Resources at 1-800- 510-4122 Ext. #4
Qualifications
Comprehensive Benefits
When you embark on a career with the Commonwealth, you are offered an outstanding suite of employee benefits that add to the overall value of your compensation package. We take pride in providing a work experience that supports you, your loved ones, and your future.
Want the specifics? Explore our Employee Benefits and Rewards!
Title 101 CMR 23.00 (“Regulation”) requires certain agency staff to have received the COVID-19 vaccination and Influenza vaccination, or have taken required mitigation measures, to prevent viral infection and transmission in State Hospitals and State Congregate Care Facilities. The Regulation applies to this position. Successful candidates will be required to acknowledge and attest to your vaccination status for both COVID-19 and Influenza.
Primary Location
: United States-Massachusetts-Boston-25 Staniford StreetJob
: Information Systems and TechnologyAgency
: Department of Mental HealthSchedule
: Full-timeShift
: DayJob Posting
: Nov 4, 2026, 3:08:09 PMNumber of Openings
: 1Salary
: 102,855.80 - 158,640.55 Yearly