How university CISOs are appointed: what three announcements show

What the sources are and what they can support

The documents are three university announcements: Penn State's of September 17, 2024, UW-Madison's of December 16, 2014, and Howard University's of March 28, 2023. They are press releases, not job descriptions, hiring policies or surveys. They show who was named, how the institution described the person, and what the role was said to cover. They do not show salary, selection criteria, board involvement or how many candidates were considered. Any conclusion here is limited to three cases.

How the appointments were announced

Penn State says Bob Turner was named CISO "following a nationwide search," effective Sept. 23, 2024.

UW-Madison's announcement says Robert Turner was named CISO after "serving for several years in a similar role as a cybersecurity consultant and compliance manager for a private firm." It says he would begin on January 7.

Howard's announcement says only that Andrea Simpson "will serve as Chief Information Security Officer." It does not mention a search.

Who the CISO answers to

The announcements quote different executives. At Penn State, the quotes come from David Horton, vice president for Information Technology and chief information officer, and from Sara Thorndike, senior vice president for Finance and Business/treasurer.

At UW-Madison, the quote comes from Bruce Maas, vice provost for information technology and chief information officer.

At Howard, the quote comes from Tashni Ann-Dubroy, executive vice president and chief operating officer. Her statement says Simpson will serve within the Office of Enterprise Technology Services.

The announcements do not state formal reporting lines. They do show that the people speaking for the appointment sit in IT leadership at two schools and in operations or finance leadership at the third.

What the role is said to cover

Penn State says the CISO provides "leadership, guidance and expertise across all units, colleges and campuses" to protect data and information systems. It adds that the CISO will advance measures that keep research and data safe and compliant within required regulatory security frameworks.

UW-Madison says the CISO is responsible for IT security resources campus-wide, as well as within the Division of Information Technology.

Maas said Turner would help provide "the right mix of security services" for the most pressing needs at UW-Madison and across the UW System.

Howard's announcement describes policy development and strategic planning. Its COO also said the unit was "fortifying the technical infrastructure" behind learning, human capital and research.

Across the three, the common elements are campus-wide scope, research and data protection, and a service or policy orientation rather than a purely technical one.

The backgrounds of the people named

Penn State describes Turner as having "decades of experience as a higher education executive, board member and thought leader." It also says he has worked in higher education and the private sector.

His prior roles, according to Penn State, include CISO at UW-Madison, field CISO for education at Fortinet, and senior manager of cybersecurity teams at Booz Allen Hamilton. He also served in the U.S. Navy.

Penn State lists his credentials as a bachelor's degree from Excelsior College, a master's degree in information assurance from Capella University, and the CISSP certification, held for 19 years.

Howard says Simpson has more than 20 years in cybersecurity and previous CISO roles at the Federal Communications Commission and AmeriCorps. It lists a master's degree from Johns Hopkins.

The cited accomplishments at the FCC include identifying duplicate web application firewalls to reallocate more than $200,000, and resolving a GAO audit with 11 findings within a year.

Penn State's acting CISO before Turner was Kyle Crain, in the post since June 2023. He returned to his role as director of consulting and architecture.

What this implies for candidates and coaches

These points follow only from the three announcements.

First, a prior CISO seat was not required in every case. UW-Madison's 2014 announcement describes the appointee's previous work as consulting and compliance management at a private firm. Penn State and Howard, by contrast, named people who had held CISO titles before.

Second, the announcements stress movement between sectors. Turner's path ran from private consulting to a university CISO role, to vendor and virtual-CISO roles, and back to a university seat. Simpson came from federal agency CISO roles.

Third, the announcements emphasize campus-wide scope, research protection, regulatory compliance, risk-based services and policy. A candidate's record in those areas matches what the institutions chose to highlight.

Fourth, the institutions also highlighted mission and culture. Turner said he wants a culture where security is not "so complex that people are afraid of it." Simpson said Howard lets her create a space for young adults to gain hands-on cyber experience.

Fifth, concrete outcomes appear in the Howard announcement: dollar figures and audit findings resolved. Whether such figures influenced the decision is not stated in any of the documents.

Gaps

None of the documents describes the search process, the interview stages, the compensation, the formal reporting line or the authority over budget. A person preparing for a higher-education CISO seat would need other sources for those questions.