Incident Responder

City of New York•New York City, NY

1d•Onsite

About The Position

The Administration for Children’s Services (ACS) protects and promotes the safety and well-being of children and families through child welfare and juvenile justice services and community supports. ACS manages community-based supports and foster care services and provides subsidized childcare vouchers. ACS child protection staff respond to allegations of child maltreatment. In juvenile justice, ACS oversees detention, placement, and programs for youth in the community. The Office of Information Technology department has the responsibility to provide high quality, reliable, sustainable technology services, and support to meet the needs of the families and children we serve through ACS, its vendor partners and other city agencies. The Chief Information Security Officer (CISO) unit is responsible for establishing and maintaining the information security program at ACS to ensure information assets and technologies are adequately protected. This unit directs staff in identifying, developing, implementing, and maintaining processes across ACS and its program divisions to reduce information and IT risks. The CISO department responds to incidents, establishes appropriate standards and controls, manages security technologies, and directs establishment and implementation of policies and procedures. Responsibilities include Computer Security Incident response team, Cybersecurity, Disaster Recovery, business continuity management, Identity and Access management, Information Privacy, Information Regulatory Compliance (PII, HIPAA, PCI/DSS), Digital Forensics and Information security operation center (ISOC). This position involves highly technical responsibilities focused on monitoring, analyzing, and supporting enterprise IT systems and infrastructure to detect, investigate, and respond to cybersecurity incidents. The role works closely with security and IT teams to ensure timely incident response, threat containment, and recovery across ACS systems.

Requirements

A baccalaureate degree in computer science, engineering or a related field from an accredited college and four years of satisfactory full-time experience related to IT automation engineering, monitoring engineering, management of infrastructure; or
Eight years of satisfactory full-time experience related to IT automation engineering, monitoring engineering, management of infrastructure;
Education and/or experience which is equivalent to "1" or "2" above.

Responsibilities

Report closely with the Chief Information Security Officer (CISO) to support the agency’s cybersecurity operations and incident response program.
Monitor, detect, analyze, and respond to cybersecurity incidents across ACS systems in coordination with internal IT teams and NYC Cyber Command.
Investigate security alerts, perform threat analysis, and coordinate containment, remediation, and recovery activities during cybersecurity incidents.
Support Security Operations Center (SOC) activities, including security event monitoring, alert triage, incident investigation, and documentation.
Assist with vulnerability management by reviewing vulnerability scan results, coordinating remediation with IT teams, and tracking mitigation efforts.
Maintain and support the agency’s Incident Response Plan, including development and updates to incident response playbooks and procedures.
Participate in and help facilitate cybersecurity tabletop exercises to test incident response readiness and coordination across teams.
Assist with the implementation, monitoring, and improvement of security tools and technologies used for threat detection and incident response.
Collaborate with technical teams to strengthen system monitoring, security automation, and operational resilience across ACS infrastructure.
Monitor emerging cybersecurity risks related to artificial intelligence (AI) technologies and support efforts to protect agency systems and data from AI-enabled threats or misuse of generative AI tools.
Assist in identifying and responding to potential cybersecurity risks associated with AI-enabled systems in coordination with the agency’s AI governance and security teams.
Maintain incident documentation, reporting, and post-incident analysis to support continuous improvement of the agency’s cybersecurity posture.