vCISO/Cyber Security Principal

Tusker is a nationwide technology solutions and services company helping organizations solve complex IT challenges and move their businesses forward. Our expertise spans cloud infrastructure, cybersecurity, managed services, modern workplace, AI, and more. We’re a growing team that values strong relationships, fresh thinking, and doing great work—for our clients and for each other. It all comes back to a simple philosophy that guides who we are: People First. Always.   The Cyber Security Principal is a senior, client-facing cybersecurity advisor who performs the function of a virtual Chief Information Security Officer (vCISO) for assigned Tusker clients. The role leads executive advisory relationships and helps clients build, govern, and mature cybersecurity programs that align security investment with business priorities, regulatory obligations, and risk tolerance.  The Cyber Security Principal owns the strategic direction and operating cadence of assigned engagements while coordinating the broader Tusker team responsible for assessment, architecture, implementation, managed services, and program support. Success requires executive presence, practical judgment, strong program discipline, and the ability to convert complex cyber risk into clear decisions, sequenced roadmaps, and measurable outcomes. Key Responsibilities

Client Executive Advisory and Engagement Leadership

• Serve as the primary trusted cybersecurity advisor to client executives, leadership teams, and boards for assigned accounts.

• Establish engagement objectives, governance, decision rights, meeting cadence, success measures, and executive reporting expectations.

• Translate technical findings, threat conditions, and compliance obligations into business impact, clear choices, and prioritized actions.

• Build durable client relationships through proactive communication, sound judgment, transparency, and follow-through.

• Manage multiple client programs while maintaining quality, consistency, and responsiveness.

Cybersecurity Strategy, Governance, and Maturation

• Assess current-state program maturity and define target-state capabilities using the framework most appropriate to each client.

• Develop and maintain multi-year cybersecurity maturation roadmaps aligned to business strategy, budgets, risk tolerance, and regulatory requirements.

• Create or improve governance structures, policies, standards, risk registers, performance measures, and reporting mechanisms.

• Guide security budgeting, investment prioritization, and risk-treatment decisions.

• Define meaningful key risk and performance indicators and use them to demonstrate progress and support executive decisions.

Risk, Compliance, Resilience, and Third-Party Oversight

• Lead or guide cybersecurity risk assessments, gap assessments, and remediation planning.

• Advise clients on alignment with NIST CSF, NIST 800-53/171, CIS Controls, ISO 27001, CMMC, PCI DSS, HIPAA, and SOC 2, as applicable.

• Support audit and assessment readiness without representing Tusker as the independent auditor or attestation body.

• Lead third-party risk discussions, vendor due diligence, and risk-based review of critical service providers.

• Develop, review, and exercise incident response and cyber resilience plans, including executive and board-level tabletop exercises.

• Advise on the secure adoption of cloud, AI, and emerging technologies.

Tusker Delivery and Growth Collaboration

• Coordinate with Tusker Solution Architects, technical delivery teams, Managed Services, Advisory, Sales, and external partners to translate roadmaps into executable work.

• Clarify ownership, dependencies, timing, and expected outcomes across strategic and technical workstreams.

• Provide cybersecurity subject-matter expertise during qualified sales pursuits, client workshops, renewals, and expansion discussions.

• Help shape repeatable vCISO methods, templates, reporting, service standards, and quality controls.

• Mentor colleagues and strengthen the ability of Tusker teams to identify advisory needs and engage the right resources.

Required Qualifications

• 12 or more years of progressive cybersecurity experience, including significant responsibility fo