DHS CISO, deputy CISO exit amid reported IT leadership overhaul

The Department of Homeland Security is undergoing an overhaul of its IT and information security leadership, with multiple sources telling FedScoop there is a broad realignment underway at the department to replace key technology leaders.

FedScoop has learned that at least two DHS officials are being replaced: Chief Information Security Officer Hemant Baidwan and Deputy CISO Amanda Day. 

The reorg among IT officials comes as other leadership is changing at the department. President Donald Trump announced Thursday that Secretary of Homeland Security Kristi Noem will be leaving the position at the end of March. Trump has nominated Sen. Markwayne Mullin, R-Okla, as her replacement. 

The announcement of Noem’s departure came a week after other personnel upheavals at the Cybersecurity and Infrastructure Security Agency, where acting Director Madhu Gottumukkala was reassigned to a DHS headquarters role and CIO Bob Costello resigned. 

Baidwan will depart the organization later this month, following Day’s exit at the end of February, according to two sources familiar with the situation. Day has since taken a job as vice president of cybersecurity and trust at Workday, FedScoop has independently confirmed. She has updated her LinkedIn profile to reflect her new job. 

Both tech leaders have spent decades working for DHS. Baidwan joined the department in 2011 as governance and risk management chief and held several positions during his tenure before being appointed head of the department’s information security team in April 2024, according to his LinkedIn. As CISO, Baidwan helped to develop the department’s first AI cybersecurity guidelines and set new standards for technology security practices. 

Day first joined the department in 2008 as an IT specialist in information security. Most recently, she was the deputy CISO and deputy executive director at DHS since December 2024. 

Baidwan and Day did not respond to multiple requests for comment from FedScoop.

Reached last week for comment, a Department of Homeland Security spokesperson told FedScoop: “We have no personnel changes to announce at this time.” The department did not respond to follow-up requests.

A “major realignment” at DHS

The overhaul could be part of the DHS IT shop’s new normal: a version of the changing of the guard that happens when new administrations come in, particularly after the role of federal CIOs has been made more political. 

However, sources familiar with the matter believe the churn signals broader change and internal friction. Two sources described Day and Baidwan’s departures to FedScoop as part of “a major realignment going on across DHS at the moment” that predates Noem’s ouster. 

Antoine McCord, DHS’s chief information officer, was described as a key player in the effort. McCord oversees IT modernization and cybersecurity across DHS and manages enterprise systems supporting border security, immigration services, disaster response, and cyber defense. 

McCord was in the first wave of CIO hires under the Trump administration last year as the Office of Personnel Management reclassified the chief information officer position from “career reserved” to “general.” The move eased restrictions on who could get tapped for the role, FedScoop previously reported.  

“Information technology impacts virtually everything the government does, and an agency CIO therefore plays a critical role in developing policies (particularly in the digital realm) that have pervasive and significant effects on the American public,” OPM said in a memo to heads and acting heads of agencies in Feb. 2025. “The modern CIO role is not the sort of ‘impartial’ or ‘technical’ position that is fit for career reserved SES positions.”

Two former DHS officials in close contact with the department told FedScoop the realignment is part of a broader effort to place individuals from DHS headquarters into critical CIO positions at component agencies, with the ultimate goal of subsuming them in part or in whole into the DHS CIO office. 

“Antoine McCord is asserting himself as the DHS CIO with the components, and when given the opportunity, he’s placing HQ people in those roles,” the official said, who spoke on the condition of anonymity to speak candidly. “There are three or as high as four major components where there are DHS CIO people running those shops now. So it’s clearly been a concerted effort to take advantage of departures and openings as well.”

Last year, Noem fired 24 FEMA IT employees, including CIO Charles Armstrong and CISO Gregory Edwards. In February, DHS quietly named Zeke Maldonado FEMA’s acting CIO. Maldonado was previously the executive director for IT operations at DHS Headquarters’ management directorate. A FEMA spokesperson confirmed Maldonado’s new role to FedScoop on March 1 and said he “will address previous challenges and take proactive steps to protect FEMA’s networks and the homeland.”

One of the sources told FedScoop that Maldonado’s appointment was also “part of a larger effort to absorb the FEMA CIO into DHS CIO.” A second source concurred with that sentiment. 

“There’s clear lines of interest in DHS CIO wanting to place people in there who could be useful in making that change,” the first official said. 

A third source described the current environment at DHS as filled with “tumult,” with most employees “jumpy” from personnel changes, lack of transparency from leadership and conflicting stories about the department’s decision making and goals. 

The departure of Costello at CISA opens up another vacant CIO position at a critical component agency. Costello was a popular leader. According to sources, his ouster will likely lead to further personnel turmoil within the agency’s IT shop. 

“There are people who are still there, who, now that Bob is gone, will leave,” the second official told FedScoop. “The brain drain at DHS is dangerous.” 

The leadership changes are surfacing as policymakers worry about DHS’s readiness to withstand physical and cyberattacks on the U.S. as the country carries out military actions targeting Iran. Already, the conflict has resulted in the first-ever combat-related disruption to a U.S.-owned hyperscale data center, DefenseScoop reported.  

“This is terrible timing, given that we are in the situation we are in the Middle East,” the second official said. “Our adversaries will absolutely capitalize on it.”