Executive Director, Security & Classified Operations and Chief Security Officer

Job Type:

Overview

RAND is a nonprofit, nonpartisan research organization that provides leaders with the information they need to make evidence-based decisions. In pursuing this mission, RAND helps sponsors at the highest levels of U.S. national and homeland security and in related roles throughout the U.S. government with their toughest problems. This requires the ability to conduct work at all levels of classification while using cutting-edge computing and analytic capabilities, and it requires RAND to remain a close and trusted partner with these officials and agencies by upholding the highest standards of security. To accomplish this, the S&CO organization works in partnership with RAND’s research divisions, Information Services (IS), and Workplace Services to ensure we have top-notch classified research capabilities and security processes that enable researchers to conduct their work effectively, efficiently, and responsibly, while maintaining uncompromising security.

Position Description

As a member of RAND’s senior leadership team, reporting to the senior vice president, chief financial and operating officer, the executive director leads the 55-person S&CO organization and serves as RAND’s Chief Security Officer. The executive director will develop and provide classified research capabilities that enable researchers in RAND’s Federally Funded Research and Development Centers (FFRDCs) and other research divisions to execute cutting-edge, complex research responsive to the top priorities of U.S. national and homeland security. This requires being able to quickly establish capabilities to meet new and evolving needs, high-performance computing that stays on the leading edge at all levels of classification (including the rapidly evolving AI capabilities that have become critical to research), and the ability to collaborate virtually across RAND offices and with a very broad array of government sponsors. Over the last few years, S&CO has significantly upgraded RAND’s classified capabilities, and its culture has been shifting from a compliance orientation to a mission-focused partnership with researchers. We’re looking for a leader to build on the progress by continuing to bring all capabilities to the cutting edge of technology particularly with respect to using an array of AI capabilities in research, deepen the partnership culture, and further develop S&CO into a high-performing, service-oriented team with a one-team mindset, all while upholding the highest standards for security to protect classified information and people.

The executive director’s scope includes:

• All RAND classified capabilities, encompassing government systems, facilities, and computing, including ensuring compute, storage, and application capabilities stay aligned with research needs and compliance requirements.
• Security policies and programs, including RAND’s National Industrial Security Program (NISP) obligations, intelligence, insider threat, counterintelligence, personnel security, physical security, safety, emergency preparedness and incident response, communications security, document control, operational security, security investigations, Sensitive Compartmented Information Facility (SCIF) operations, and Special Access Program (SAP) operations.
• The hiring and development of classified IT and security staff across RAND’s U.S. offices in Santa Monica, Pittsburgh, and Arlington. In managing classified IT, the executive director works in close partnership with the Chief Information Officer (CIO) and the rest of IS regarding the acquisition and maintenance of IT and the hiring and development of IT staff. The executive director also has advisory responsibility for security matters for RAND’s non-U.S. offices.

Responsibilities

• In partnership with RAND leadership and research divisions, establish the department’s vision, strategy, goals, and execution priorities; ensure staff understand them; and lead execution, using metrics to track and communicate progress.
• Ensure robust policies, procedures, and processes are in place and well implemented to effectively manage the department, provide classified computing capabilities to research staff, and provide security to RAND associates across the globe, continually streamlining processes to improve speed and service.
• As RAND’s Insider Threat Program Senior Official and CSO, direct efforts to assess and mitigate risk, including insider threat and counterintelligence risks; manage incidents; and safeguard the organization and its ability to conduct all work.
• Ensure compliance with NISP, intelligence community, contractual, executive order, and other federal requirements for classified operations.
• Serve as the principal security liaison between RAND and the security organizations of its sponsors in the Departments of War and Homeland Security and the Intelligence Community, building executive-level relationships with these organizations, DCSA, and law enforcement agencies to facilitate responsiveness to RAND’s needs.
• Keep abreast of the regulatory environment and emerging security and computing technologies, including AI and classified cloud offerings, and drive their adoption so that RAND’s classified research capabilities stay at the leading edge.
• Lead and manage security and classified computing resources, staff, and facilities:

o Determine staffing needs and attract, hire, and retain high-caliber staff.

o Guide the development of department staff to continually improve capabilities, ensure effective career development, and create succession readiness for all key positions; mentor managers and empower staff to take initiative.

o Lead the performance management process for department staff, setting high but reasonable expectations and holding managers and staff accountable for results.

o Develop and manage the department budget, aligning resources with strategic priorities and adjusting them as circumstances change.

• Serve as the primary security contact with the directors of RAND research divisions. Maintain familiarity with their research plans to proactively deliver capabilities and provide security and classified computing expertise for their programs and projects.
• Ensure the maintenance of facility accreditations and the authorization of all classified information systems and secure communication systems, overseeing RAND’s interactions with DCSA, DIA, DISA, the military departments, and other government agencies on authorizations and maintaining continuous readiness for government inspections.
• Act as the focal point for administering SCI and SAP programs for all government sponsors.
• Manage the travel security program, including international travel security and safety briefings and security threat analysis.
• Maintain a robust security education and awareness program for all RAND staff that communicates security’s role in enabling the mission.
• Maintain a comprehensive emergency response, business continuity, and disaster recovery program to include plans, exercises, incident response, and training.

Preferred Qualifications

Security

• In-depth knowledge of special security regulations for U.S. government sponsors.
• In-depth knowledge of 32 CFR Part 117 (NISPOM), Intelligence Community Directives (ICDs), the Joint SAP Implementation Guide (JSIG), and Security Executive Agent Directives (SEADs).
• Significant experience managing special security facilities and providing associated computing and communications capabilities.
• Established relationships with government security counterparts.
• Experience preparing for and managing incident response regarding security and safety events.
• Experience in designing and conducting security education and training programs.
• Familiarity with U.S. export control regulations.

Information Technology (IT)

• Broad knowledge of IT operations, information assurance, and classified system authorization (e.g., the Risk Management Framework); familiarity with the latest computing capabilities, including cloud offerings and AI; and sufficiently deep IT knowledge to lead an IT workforce.
• Experience integrating large language models and AI-based applications into classified computing environments.

Leadership and Management

• Proven ability to attract, develop, and retain talent and to build high-performing teams and organizations.
• Demonstrated ability to establish a respectful, results-focused environment that empowers and motivates staff (“eyes on, hands off”) while holding staff accountable, being accessible, and leading by example, including a willingness to roll up one’s sleeves.
• Experience establishing organizational strategies, goals, and implementation priorities in partnership with key stakeholders across an organization, putting the mission and the good of the institution above organizational equities.
• A track record of leading change and continuous improvement: taking the initiative to prevent or solve problems, questioning past practice, and transforming processes and organizational culture.
• Experience leading an organization with a reputation for exceptional customer service that balances rigorous compliance with agile support to the mission.
• Experience managing a budget, using data to inform decisions, and shifting priorities and resources as changing circumstances require.
• Excellent judgment and managerial courage: analytical and open to input, yet able to navigate ambiguity, act decisively on the best available information, and lead calmly under pressure or in a crisis.
• Strong written and verbal communication and influence skills, including the ability to build trusted relationships with researchers, senior leaders, and government officials and to frame security in terms of the mission.

Education and Certifications

• An advanced degree in business, computer science, security or a related field is a plus.
• American Society for Industrial Security Certified Protection Professional (ASIS CPP) certification is a plus.
• Memberships in Industrial Security Working Group (ISWG) and Contractor SAP Security Working Group (CSSWG) are a plus.

Experience

• 10+ years of progressively responsible security, classified support, and/or IT experience, including at least 5 years in management and direct experience in both classified security and IT-related leadership roles; at least 15 years of experience preferred. Consideration will also be given to those with significant management experience and deep familiarity with classified research and analysis and its supporting capabilities and requirements.
• Experience working with a highly analytical knowledge-based workforce is preferred.

Security Clearance

Active, transferable Top Secret clearance with SCI access, and eligibility for SAP access.

Location

RAND Offices in Arlington, VA, Santa Monica, CA, or Pittsburgh, PA

• This position is office-based.
• Travel of approximately 25% within the U.S. is required.

Application Review

Application review will begin November 25

Salary Range

$273,000 – $396,825

RAND considers a variety of factors when formulating an offer, including but not limited to, the specific role and associated responsibilities; a candidate’s work experience, education/training, skills, expertise; and internal equity. The salary range includes base pay plus RAND’s sabbatic pay (which provides additional compensation above base pay when vacation is taken). In addition, RAND provides strong benefits including health insurance coverage, life and disability insurance, savings plan, paid time-off and more.

Equal Opportunity Employer