Universities are built to be open. Anyone can apply, researchers collaborate across institutions, and thousands of students, faculty, and staff need access to systems every day. That openness is what makes them valuable, and it is also what makes them hard to protect. The five CISOs below secure public universities in Virginia, Idaho, Florida, Georgia, and Kansas, and each has found ways to protect students, research, and data without closing off what a university is for.
Matthew Dalton – CISO, George Mason University
Higher education runs in Matthew Dalton’s family. According to family stories, his great-grandparents met because they taught at the same college. As CISO of George Mason University since May 2025, he sees his job as setting a security strategy that allows “the flexibility and freedom necessary for creative, educational, and research endeavors,” while preventing the harm cyber incidents cause. He has said that user credentials are now “the keys to the kingdom,” and that security has to move closer to the individual rather than the device or network. In 2026 his team launched a phishing simulation program, which he compares to an inoculation: people who take the bait are “released back into the pond” with information to keep them safe, rather than penalized. He brings more than 25 years at research universities, including nine years as CISO of the University of Massachusetts Amherst, where he also served as interim director of research computing, and eight years leading information security at Ohio University.
Brandon Bowlin – CISO, Boise State University
Fraud in college applications is not a problem most people associate with cybersecurity. Brandon Bowlin has described how it works: bad actors use stolen personal information belonging to 18-year-olds to apply to universities and for financial aid, then collect refunds when the aid exceeds tuition, leaving victims with debt and drawing in the FBI. In a 2024 interview, he explained Boise State’s layered response, including third-party identity verification, so applicants do not hand their IDs or Social Security numbers directly to the university, and more secure ways to transfer application documents. He acknowledged that the extra steps make things a little more cumbersome for legitimate applicants. CISO since September 2023, he also chairs the university’s Data Governance Committee. He came from the corporate world, after a decade in the Marine Corps, where he enlisted after high school and later returned as a communications officer, followed by IT leadership at Bechtel and Avanade and years as a consultant and fractional CISO. Working at a university, he has said, is a bit like working in a city government: “You’ve got a little bit of everything.”
Helvetiella Longoria – CISO, Florida International University
“Nobody really wanted to do anything with them,” Helvetiella Longoria has said of the first firewalls Florida International University brought onto its network about two decades ago. She was running infrastructure servers at the time, so she volunteered to take them on. That decision started a career in security that led to FIU’s CISO role, which she has held since 2017. FIU credits her with rolling out two-factor authentication to more than 80,000 users, launching a cybersecurity awareness training program, and establishing vulnerability management. In 2014 she received the Center for Digital Government’s Cybersecurity Leadership and Innovation Award in the education category, and she has served on the organizing committee for the NIST-led National Initiative for Cybersecurity Education conference. At FIU’s AI 305 conference, she warned that “the attacks are coming faster,” with generative AI making phishing emails nearly indistinguishable from legitimate ones.
Stephen Gay – AVP, Cybersecurity & CISO, Kennesaw State University
Stephen Gay has spent almost his entire career at Kennesaw State University. He joined the staff in 1997, led its information security office for years, and, after a brief stint as director of security governance and communications at Elavon, returned as CISO in 2015. In June 2025 he became associate vice president for cybersecurity and CISO. His office leads security operations, governance, risk management, policy, compliance, and awareness, and plays a federated role, working closely with research security teams to support regulated data environments. He is also a three-time Kennesaw State graduate, with a master’s in cybersecurity and bachelor’s degrees in political science and information security and assurance, and was selected for the University System of Georgia’s Executive Leadership Institute in 2024. He has presented nationally on cybersecurity leadership, program management, awareness, and fostering diversity in IT, and in 2026 joined Dalton on an EDUCAUSE webinar about the higher education CISO’s evolution from technical manager to institutional strategist.
Mark Rodee – CISO, Wichita State University
Mark Rodee came to higher education from the defense industry. He spent nearly two decades at Cobham as information security director and data scientist before becoming CISO of Wichita State University in February 2020, where he protects student and research data. Alongside that work, he has focused on helping to grow the next generation of cyber defenders and drawing attention to the value of public service.
Open by Design
Dalton protects academic freedom while building safer habits. Bowlin guards the admissions and financial aid process without shutting out real applicants. Longoria brought authentication to a campus of tens of thousands, Gay coordinates security with research teams, and Rodee protects student and research data at a growing public university. Each is securing an institution that cannot simply lock its doors.
Discover more CISOs securing their organizations:
-
- Banking Without a Branch: Europe’s Digital Finance CISOs to Watch
- Securing the Physical Economy: Europe’s Industrial Cyber Leaders to Watch
- Ready Before It Happens: New Zealand’s Cyber Readiness Leaders to Watch
- Protecting the Mission: Australia’s Not-for-Profit Cyber Leaders to Watch
- Behind the Deputy Title: The Deputy CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.