Fractional Virtual CISO & Cybersecurity Practice Lead

Position Overview You will serve as the senior cybersecurity practitioner and virtual CISO to a growing portfolio of mid-market clients (typically $25M–$150M in revenue, 100–1,000 employees). You will own the full client lifecycle, from initial security risk assessments through ongoing advisory, compliance management, and incident response coordination. Key Responsibilities • Serve as the outsourced CISO for 8–12 clients, providing executive-level security leadership on a fractional basis • Conduct security risk assessments, gap analyses, and penetration testing oversight for prospective and current clients • Develop and maintain security programs, policies, and incident response plans tailored to each client's risk profile and regulatory environment • Manage compliance frameworks including SOC 2, HIPAA, PCI-DSS, CCPA, NIST CSF, and CMMC • Present security posture, risk exposure, and remediation roadmaps to boards of directors, C-suites, and audit committees in clear, business-oriented language • Oversee and leverage AI-driven security tooling for vulnerability scanning, log analysis, threat detection, and compliance evidence collection • Quarterback incident response when clients face active threats or breaches, coordinating forensics, legal, communications, and remediation • Collaborate with RMC's reputation management team to deliver integrated crisis response when security events create reputational exposure • Participate in business development — joining sales conversations, scoping engagements, and helping close new cybersecurity retainers • Recruit, manage, and mentor junior analysts as the practice scales • Build standardized methodologies, reporting templates, and delivery playbooks that allow the practice to scale without sacrificing quality Qualifications • 7-10+ years of hands-on cybersecurity experience spanning at least two of the following: penetration testing, incident response, security architecture, GRC (governance, risk, and compliance) • 3+ years operating at the CISO, Director of Security, or senior consulting level, you've sat in the room with boards and translated technical risk into business impact • CISSP certification (active and in good standing) • Deep working knowledge of SOC 2, HIPAA, NIST CSF, and at least one additional framework (PCI-DSS, ISO 27001, CMMC, CCPA) • Experience building or significantly expanding a security program from early stages, not just maintaining one someone else built • Ability to manage multiple client engagements simultaneously without quality degradation • Comfortable participating in sales and business development conversations — you understand that your credibility is what closes deals Nice-to-Haves • CMMC Registered Practitioner (RP) or Certified CMMC Assessor (CCA) — the Southern California defense industrial base is a priority vertical • Additional certifications: CISM, CRISC, OSCP, GPEN, or SANS GIAC credentials • Experience running a cybersecurity consulting practice, MSSP, or vCISO firm — either as founder or practice lead • Background in incident response or digital forensics • Familiarity with AI-driven security platforms and willingness to integrate emerging AI tooling into service delivery • Experience with cyber insurance underwriting requirements and risk assessment frameworks • Existing professional network in the Southern California cybersecurity community What Will Set You Apart • You've built something before, a practice, a team, a firm, and you want to do it again with resources and infrastructure behind you • You can explain a zero-day exploit to a board member and a budget justification to a CFO in the same meeting • You're not just a technician who moved into management, you genuinely enjoy the client relationship and advisory aspects of the work • You see AI as a force multiplier for your expertise, not a threat to it Compensation & Structure • Base salary: $200,000 – $300,000 depending on experience and credentials • Performance bonus: Up to 25% of base, tied to client acquisition, retention, and practice revenue targets • Revenue participation: Structured incentive on new business you source and close, designed to reward you as a practice builder, not just a practitioner • Benefits: Health, dental, vision, 401(k) • Equity / profit-sharing potential: As the cybersecurity division scales, this is a founding role and we structure compensation to reflect that Work Arrangement Remote