Public-sector and university CISOs: how the role and path differ from corporate security

What these three documents can and cannot tell you

The question asks how CISOs in higher education and state government get appointed, what they own, and how the job differs from a corporate role. This guide uses three primary documents: a Howard University appointment announcement, a Nevada Governor's Technology Office appointment release, and an Oklahoma Office of Management and Enterprise Services (OMES) release about Cybersecurity Awareness Month.

The limits are real. Two of the documents are appointment announcements and the third is an awareness-month release. None describes a hiring process, a job description, a reporting-line policy or a corporate comparison. The sections below report what each document says. Where a comparison with corporate work is possible, the guide marks what the documents support and what they leave out.

How the appointments were announced

Howard University's announcement is dated March 28, 2023. It says that Howard University is pleased to announce Andrea Simpson will serve as Chief Information Security Officer. The introduction of the new CISO came from an executive, not from the security function. The announcement quotes Tashni Ann-Dubroy as the executive vice president and chief operating officer of Howard University.

Nevada's release is dated March 30, 2026. The Governor's Technology Office says that Bertrum Carroll has joined the Office of Information Security and Cyber Defense as Nevada's State Chief Information Security Officer. The release does not describe a search, a selection panel or a confirmation step. It quotes the State Chief Information Officer and the deputy director of the security office, which shows who spoke publicly for the appointment but not who made the decision.

Oklahoma's release is dated October 1, 2026. It is not an appointment announcement. It names the State Chief Information Security Officer and shows where that person sits in the state's structure.

None of the three documents says how the appointee was chosen. They differ only in who announced the news and where the new CISO sits.

The path to the seat, as the announcements present it

Both appointment announcements give prior CISO-level work as part of the case for the hire. Howard's announcement says Simpson has more than 20 years in the field, including CISO roles at two federal bodies. The announcement also lists her education.

Howard's announcement gives specific results from her federal work. It says she reallocated more than $200,000 by finding duplicate firewalls and resolved a Government Accountability Office audit within a year.

Nevada's release describes Carroll's background in terms of executive security leadership. It says he has more than a decade of such experience, including a vice president and CISO role covering strategy, risk and compliance. The release does not say what kind of organization he served in that role. This guide therefore does not call it a corporate role.

The release also lists his certifications. It describes him as a retired U.S. Army lieutenant colonel. It does not say that any credential or background is required for the post.

The Oklahoma release gives no career history for its State CISO.

What the documents say these CISOs own

The documents describe ownership in three different forms.

University. Howard's announcement places the CISO inside the Office of Enterprise Technology Services, in policy and planning work. It says the CISO will serve within that office in policy development and strategic planning roles. The announcement does not list systems, budgets or staff.

State, Nevada. The release describes the security office's function more than the CISO's personal remit. Through the Office of Information Security and Cyber Defense, the Governor's Technology Office helps state agencies. The release also records Carroll's stated plan for his first days. In his first days with the state, Carroll said his priority was to listen, learn and build on what was already working.

He also named the topics he expects security leaders to cover as artificial intelligence spreads. He said they must think about governance, workforce training, vendor expectations and the responsible use of data.

State, Oklahoma. The release describes an operating team rather than an advisory function. It says the state's central cybersecurity team monitors and responds around the clock. The same release says the Oklahoma Information Sharing and Analysis Center was set up as a multiagency effort.

OMES itself is a shared-services agency. The release says it provides several functions to every state agency. The release places the State CISO's team inside that structure.

Where the job reads differently from a corporate role

The documents never describe a corporate CISO, so every difference below is a contrast with what the documents say about these roles. It is not a measured comparison.

The stated audience is the public. Nevada's release frames the job around public data and public trust. In Carroll's words, the job is about managing risk in a deliberate, responsible way that protects public trust. The release does not mention shareholders, customers or a board.

The stated customers are other agencies. Carroll said good security leadership begins with understanding the needs of the agencies the state office supports. The Nevada security office is described as supporting state agencies, not running security for a single business.

The mission can include education. Simpson said that Howard gives her a chance to build a hands-on cyber experience path for young adults. The announcement attaches this goal to the CISO role at the university.

The reporting line is visible in the announcement. Howard's announcement came from the chief operating officer, and Nevada's release quoted the State CIO. Oklahoma's release shows the State CISO leading a team inside a central services agency. These are the reporting lines the documents show. They do not say how any of them compares with where a corporate CISO sits.

What the documents leave open

Several parts of the question cannot be answered from these three documents:

• How a university or a state selects a CISO, including who approves the hire.
• Whether any credential or prior role is a formal requirement.
• Budget, staffing and authority over agencies or schools.
• How regulation, procurement or legislative oversight shape the work.
• Any measured difference in pay, tenure or board access against corporate roles.

A reader building a profile of a public-sector or university CISO can use these announcements for three things: the title, the office the person sits in, and the background the institution chose to highlight. For anything beyond that, such as the appointment process, the formal requirements or the corporate contrast, the reader would need other primary sources, such as job postings, statutes or governance charters.