Deputy Chief Information Security Officer

State of Connecticut•Hartford, CT

9d•Hybrid

About The Position

The State of Connecticut, Department of Administrative Services (DAS), Bureau of Information Technology Solutions (BITS) is recruiting for an anticipated Deputy Chief Information Security Officer (Information Technology Manager 3). This role will help lead information security for the Connecticut executive branch. BITS runs the state's shared technology services and its enterprise security program, protecting the systems and data of executive branch agencies. The Deputy Chief Information Security Officer position leads the Compliance, Audit and Architecture division and reports to the state Chief Information Security Officer (CISO). The Deputy CISO leads and owns the security audit compliance program for the data the state holds under federal regulation, including but not limited to: payment card data (PCI DSS), federal tax information (IRS Publication 1075), protected health information (HIPAA), substance use disorder records (42 CFR Part 2), criminal justice information (CJIS), and Social Security Administration data. This position has delegated authority to act for the CISO when absent or unavailable, may direct Security Operations staff during a declared incident, serves as the named alternate in regulatory and incident-notification decisions, and holds authority to accept information security risk on the state's behalf up to a threshold established by the CISO.

Requirements

Ten (10) years of experience in computer or network administration, architecture, operations, production control, systems development, information technology analysis and planning.
One (1) year of the General Experience must have been in a managerial capacity.
For state employees, this experience is interpreted at the level of an Information Technology Manager 2.
College training in computer science, management information systems or a closely related field may be substituted for the General Experience on the basis of fifteen (15) semester hours equalling one half (1/2) year of experience to a maximum of four (4) years for a Bachelor’s degree.
A Master’s degree in computer science, management information systems or a closely related field may be substituted for one (1) additional year of the General Experience.

Nice To Haves

Possession of current Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC) or Certified Information Systems Auditor (CISA) certifications
Experience supervising employees who perform information security functions
Experience working in an information security compliance program in an organization subject to federal regulatory audit
Experience establishing an enterprise information security program based on a recognized control framework
Experience conducting security risk assessments that resulted in documented risk-acceptance decisions

Responsibilities

Direct the enterprise security compliance program for regulated data, including but not limited to PCI DSS, IRS Publication 1075, HIPAA, 42 CFR Part 2, CJIS, and Social Security Administration requirements
Oversee security risk assessments of State, Agencies, & supporting Vendor systems and maintain the record of risk decisions
Plan security audits and coordinate agency responses to regulatory examinations
Spearhead the executive branch agency information security program by establishing enterprise-wide security priorities and standards
Develop, update and maintain security policy, standards, and the security roadmap in support of the CISO's strategy
Represent the security program to agency leadership and external oversight bodies
Manage the division's budget, staffing, and work assignments
Acts with the full authority of the CISO when the CISO is absent or unavailable
May direct Security Operations staff and resources during a declared incident, including staff outside this position's normal reporting line
Serves as the named alternate, alongside legal counsel, in regulatory and incident-notification decisions
Holds authority to accept information security risk on the state's behalf up to a threshold established by the CISO
Plans, organizes and manages all operations and activities of an information technology services unit, division, function or location
Responsible for meeting all data processing or information technology needs of the respective unit, division, function or location
Establishes priorities for systems development and information technology projects in accordance with agency requirements
Coordinates, plans and manages solution architecture projects
Directs the planning, design and implementation of complex storage solution configuration
Develops plans for future utilization information technology services in the overall agency program
Ensures the development of high quality, low-cost technology solutions aligned with the needs of the State and its agencies within the financial resources of the agency
Aligns information technology planning with the business strategy
Leads and influences the development of standards and decisions regarding changes to systems/applications
Manages information systems activities within areas such as IT infrastructure and architecture, applications development, networks, computer operations and support
Oversees information technology projects from conception to completion
Works with leadership team to maximize cross-team contributions
Leads information technology operations to ensure exceptional quality and timely response to all customer service issues
Interfaces regularly with clients/customers
Stays abreast of local, regional and national industry trends
Understands the major economic, political, technological and competitive trends affecting technology
Searches out challenging opportunities to change, grow, innovate and improve to capture competitive advantages
Compares information technology with those of significant competitors and makes appropriate adjustments
Coordinates the use of key people, resources, technologies, process, and capabilities to reach strategic goals
Sets an example by acting in ways that are consistent with shared department values
Fosters collaboration by promoting cooperative goals, building trust and enlisting others in a common vision
Strengthens staff by providing choice, developing competence and offering visible support
Focuses on continuous learning for self and staff
Actively acknowledges individual and team accomplishments
Leverages technological solutions to meet business needs
Participates in the recruitment and hiring of staff, including outreach, interview and selection