City and local-government CISOs: securing municipal operations and connected infrastructure

What the Arlington post records

When the City of Arlington, Texas, introduced its security chief, the city's news post described a combined position: an assistant director who also serves as Chief Information Security Officer.

The city's Office of Communication published the post on August 22, 2023.

The dual title is the clearest structural detail the post gives. It does not name the department behind the assistant director half of the title. It also does not list the duties attached to either half.

The newsletter that introduced the CISO falls under a technology priority, which the city council named as one of its six priorities.

The city says technology also supports its other priorities, and one of those is regional mobility.

Connected traffic systems in the same issue

The edition that introduced the CISO also covered a traffic program, the Freight Optimization Services Program, which the city says it announced in May. The city describes the program as cloud-based signal technology meant to cut stops and delays for heavy freight vehicles.

According to the post, the program is to run on designated freight routes and in freight-oriented development areas.

This is the connected-infrastructure side of the question. The post places the traffic program and the CISO introduction side by side in one newsletter. It does not state that the CISO is responsible for the signal system, and it does not describe how that system is secured. The record shows the two items appeared in the same publication. It does not document a reporting line between them.

Outreach beyond city hall

A University of Texas at Dallas event page lists Bryce Carter as CISO of the City of Arlington, speaking at the Naveen Jindal School of Management's first Cybersecurity Day. The page dates the event October 17, 2024.

The agenda places Carter on an 11:15 AM panel with CISOs from Interstate Batteries, UT Dallas and XPO Logistics.

The event page says Carter's work covers community welfare as well as data protection.

The same profile says he holds positions on multiple advisory boards.

It also says he mentors people entering the field.

These are the outreach activities the profile names: a university panel, advisory board seats and mentoring. The page does not name the boards. It also does not say whether this work is part of the city job or separate from it.

The same page describes a private-sector peer's duties in more specific terms. It lists the functions the Texas Health Resources CISO runs.

No matching list of functions appears for the city CISO. Neither the event page nor the Arlington post states which teams or systems the city seat directs.

Where state CISOs appear

A Billington CyberSecurity release on Business Wire, dated February 24, 2026, announced a State and Local CyberSecurity Summit in Washington for March 9 to 11, 2026.

The release frames the summit around every tier of government below the federal level.

The release says the speakers come from many states, and in its list the only security seat tied to a city is Bruce Coffing, CISO of the City of Chicago.

The state titles in the list differ from one another. Kansas lists its CISO under a named state office.

New Jersey's security chief carries a director title as well as the CISO title.

Minnesota adds the word "State" to the formal title.

Texas, where Arlington sits, is represented at the state level by a separate cyber body. The release lists its chief among the headliners.

How the two seats differ in this record

Read together, the documents separate the city and state seats mainly by title and setting. They do not separate them by a list of duties.

On the city side, the Arlington post pairs the CISO title with an assistant director title. The post appears next to a traffic signal program and under council priorities that include regional mobility. The UT Dallas page presents the Arlington CISO through local outreach: a university panel, advisory boards and mentoring.

On the state side, the Billington release presents CISOs tied to state offices. Kansas lists its CISO under an information security office, New Jersey uses a combined CISO and director title, and Minnesota uses a formal state title. In Texas, a separate Texas Cyber Command appears alongside these state roles.

The release also describes how the tiers connect. Its organizer argues that the levels of government cannot work apart.

What the record leaves open

None of the three documents sets out a formal job description for a city or state CISO. Several questions remain unanswered by the documents:

• They do not say whether the Arlington seat covers traffic signal systems.
• They do not give budgets, staff counts or reporting lines for any of the government roles.
• They do not explain how a city CISO and a state CISO in the same state divide their work.

A profile of a specific municipal security leader would need a city job posting, an organization chart or the leader's own account to fill those gaps.