Chief Information Security Officer (Contract)

State of Illinois•Springfield, IL

3d•Hybrid

About The Position

Serves as the Department's Chief Information Security Officer, leading the agency information security program in coordination with the Department of Innovation and Technology. Establishes, maintains, and enforces the Department's information security policies, standards, and procedures consistent with the Department of Innovation and Technology enterprise security framework, applicable National Institute of Standards and Technology standards, and the Federal Bureau of Investigation Criminal Justice Information Services Security Policy. Develops and administers the Department's information security risk management program, including periodic risk assessments, security control assessments, and plans of action and milestones. Provides administrative input into the development of Department information technology policies, standard operating procedures, and security-related directives. Assesses and evaluates the effectiveness of information security operations, policies, procedures, and internal controls, and drives continuous improvement based on assessment findings, audit results, and threat trends. Advises Department executive leadership on information security posture, emerging risks, and resource requirements. Serves as the Department's designated security official and Information Security Officer for regulated data, ensuring compliance with state and federal information protection requirements. Serves as the designated security official for protected health information under the Health Insurance Portability and Accountability Act Security Rule for the Department's electronic health record environment. Serves as the agency Information Security Officer for criminal justice information under the Federal Bureau of Investigation Criminal Justice Information Services Security Policy. Administers compliance with the Personal Information Protection Act and the Identity Protection Act, including safeguards for personal information and Social Security numbers. Maintains the Department's data classification and data handling standards across the Microsoft 365 environment, the electronic health record system, the offender management system, and other systems of record. Coordinates information security obligations arising under the Freedom of Information Act and applicable records retention requirements with the Office of the General Counsel and the Department Freedom of Information Act Officer. In carrying out this designated security official role, implements and oversees the technical safeguards required to keep protected health information secure; prevents unauthorized access to protected health information through access controls, authentication, and audit controls; establishes and implements procedures for the secure transmission of electronic protected health information (ePHI), including encryption in transit; and determines and maintains requirements for the proper storage of ePHI, including encryption at rest and retention. Directs the Department's security operations, incident response, and breach notification activities in coordination with the Department of Innovation and Technology. Establishes and maintains the Department's incident response plan and serves as the agency point of accountability for information security incidents. Coordinates detection, containment, investigation, and recovery activities with the Department of Innovation and Technology security operations and, where applicable, law enforcement. Administers breach notification determinations and timelines required under the Personal Information Protection Act and other applicable authorities. Oversees identity and access management, privileged access controls, and insider threat monitoring across Department systems and facilities. Governs the security of connected operational technology across Department facilities, including surveillance, access control, body worn camera, and related systems. Serves as the Department's information security lead for external audits, compliance reviews, and oversight inquiries. Serves as primary point of contact for the Office of the Auditor General, the Department of Innovation and Technology, Federal Bureau of Investigation Criminal Justice Information Services audits, internal audit, and other oversight bodies on information security matters. Coordinates the Department's information security audit response, including document production, walkthrough interviews, finding responses, and corrective action plans. Tracks open findings, management responses, and remediation status through closure. Prepares security briefing materials, attestations, and exhibits as needed. Plans, develops, and delivers information security training and awareness across the Department. Designs and conducts security awareness training for Department staff and role based training for staff handling criminal justice information, protected health information, and other sensitive data. Develops and maintains security reference materials, acceptable use guidance, and incident reporting procedures. Promotes a culture of security awareness and accountability across Department divisions and facilities. Performs other duties as required or assigned which are reasonably within the scope of the duties enumerated above.

Requirements

Bachelor’s degree from an accredited college or university in information security, computer science, information technology, or a closely related field.
A minimum of five (5) years of progressively responsible professional experience in information security, including experience developing and administering information security policies and risk management programs.
Demonstrated working knowledge of NIST security standards, the FBI CJIS Security Policy, and the HIPAA Security Rule.
Ability to pass the IDOC/IDJJ background check.
Ability to pass a drug screen.
Required to utilize digital technology, tools, platforms, and processes in managing and supporting various digital enhancements for greater efficiency, productivity, and digital transformation efforts within the department.

Responsibilities

Serves as the Department's Chief Information Security Officer, leading the agency information security program.
Establishes, maintains, and enforces the Department's information security policies, standards, and procedures.
Develops and administers the Department's information security risk management program.
Provides administrative input into the development of Department information technology policies, standard operating procedures, and security-related directives.
Assesses and evaluates the effectiveness of information security operations, policies, procedures, and internal controls.
Advises Department executive leadership on information security posture, emerging risks, and resource requirements.
Serves as the Department's designated security official and Information Security Officer for regulated data, ensuring compliance with state and federal information protection requirements.
Administers compliance with the Personal Information Protection Act and the Identity Protection Act.
Maintains the Department's data classification and data handling standards.
Coordinates information security obligations arising under the Freedom of Information Act and applicable records retention requirements.
Implements and oversees the technical safeguards required to keep protected health information secure.
Prevents unauthorized access to protected health information through access controls, authentication, and audit controls.
Establishes and implements procedures for the secure transmission of electronic protected health information (ePHI), including encryption in transit.
Determines and maintains requirements for the proper storage of ePHI, including encryption at rest and retention.
Directs the Department's security operations, incident response, and breach notification activities.
Establishes and maintains the Department's incident response plan and serves as the agency point of accountability for information security incidents.
Coordinates detection, containment, investigation, and recovery activities with the Department of Innovation and Technology security operations and, where applicable, law enforcement.
Administers breach notification determinations and timelines required under the Personal Information Protection Act and other applicable authorities.
Oversees identity and access management, privileged access controls, and insider threat monitoring across Department systems and facilities.
Governs the security of connected operational technology across Department facilities.
Serves as the Department's information security lead for external audits, compliance reviews, and oversight inquiries.
Coordinates the Department's information security audit response.
Tracks open findings, management responses, and remediation status through closure.
Prepares security briefing materials, attestations, and exhibits as needed.
Plans, develops, and delivers information security training and awareness across the Department.
Designs and conducts security awareness training for Department staff and role based training for staff handling sensitive data.
Develops and maintains security reference materials, acceptable use guidance, and incident reporting procedures.
Promotes a culture of security awareness and accountability across Department divisions and facilities.
Performs other duties as required or assigned.