IT Information Security Analyst, Senior

Dakota County•Hastings, MN

About The Position

Dakota County is seeking a senior-level technical expert in information security to work with Information Technology management and staff. The position helps establish and monitor County security standards, practices, and systems to protect the confidentiality of County information assets. The analyst applies technical expertise in information systems, security practices and technologies, security controls, and methods, along with working knowledge of government security and privacy issues and relevant laws. The role also requires strong communication and relationship-building skills with County managers, technical staff, and representatives of external government agencies. The analyst researches threats and emerging technologies, recommends policy and process improvements, evaluates and supports deployment of security technologies, and helps ensure security is addressed throughout technology projects. The position monitors compliance with applicable security frameworks and laws, assesses risks and vulnerabilities, advises on security requirements, and leads or supports security assessments and remediation. The role includes contributing to security training and performing other duties as assigned. The position is full-time, based at the Hastings ADC, with standard hours Monday through Friday, 8:00 a.m. to 4:30 p.m. On-call availability is required as needed. The work includes extended periods of desk and computer use, and some work from home is available.

Requirements

Bachelor's degree in computer science, information systems, or information security and 3 years of experience supporting IT security infrastructure; or an associate degree in one of those fields and 5 years of relevant experience; or 7 years of equivalent education and experience in IT security infrastructure.
Knowledge of technology trends and developments related to security and risk management.
Strong understanding of information security controls, risks, and threats.
Understanding of and experience with network protocols, including switches, routers, and routing technologies.
Strong working knowledge of Microsoft Windows Server environments, VMware Server, Microsoft M365, Veeam Backup, and other enterprise-wide applications.
Strong knowledge of enterprise security technologies, such as VPN, encryption, firewalls, intrusion detection and prevention, and antivirus.
Knowledge of information security standards, data privacy and computer crime laws, and state and federal data protection laws.
Knowledge of information security audit and assessment methodologies, policies, standards, procedures, and best practices.
Ability to conduct risk management assessments and assist diverse users in identifying, prioritizing, and remediating information systems vulnerabilities.
Business process and reengineering experience.
Knowledge of systems development life cycle methodologies.
Familiarity with national security standards organizations and industry leaders in security excellence.
Ability to work in a flexible environment where requirements and procedures continuously evolve.
Self-motivated and self-directed, able to absorb new ideas and concepts quickly, and attentive to detail.
Strong analytical and troubleshooting abilities and ability to prioritize and execute tasks in a high-pressure environment.
Ability to make technical decisions with limited resources and precedence.
Strong customer service orientation and written, oral, interpersonal, and presentation skills.
Experience working in a team-oriented, collaborative environment.
Ability to use discretion and handle sensitive or confidential information.
Ability to work standard County business hours Monday through Friday, 8:00 a.m. to 4:30 p.m., and be available on call as required.
Ability to perform extended periods of desk and computer work.

Nice To Haves

Certified Information Systems Security Professional (CISSP).
CompTIA Advanced Security Practitioner (CASP+).
Certified Security Analyst (CSA).

Responsibilities

Research and stay informed about information security threats, industry trends, emerging technologies, and response alternatives.
Recommend improvements to County information security policies, procedures, and guidelines.
Assess and monitor user-access processes for account creation, modification, and removal, and assist with recommended improvements.
Research, assess, and help deploy security technology solutions, including encryption, firewalls, authorization, authentication, intrusion detection, and gateway security controls.
Assist with approval, tracking, and reporting of security exceptions.
Prepare status reports analyzing security risks and vendor security controls and recommend solutions to address vendor security technology performance or capability issues.
Collaborate on critical technology projects to address security throughout the project life cycle.
Assist with recommendations for security improvements and tool acquisition to the County Board and senior management.
Assist in evaluating and using security technologies and tools and provide deployment guidance.
Work with auditors to demonstrate processes and ensure appropriate access throughout information and identity life cycles.
Participate in planning, selecting, and implementing an identity management solution.
Advise application development and acquisition projects on security requirements and controls and assess whether controls are implemented as planned.
Maintain, manage, and monitor County compliance with security control frameworks and applicable laws, including CJIS Security Policy, HIPAA, IRS Tax 1075, and PCI-DSS.
Assess the current IT security environment, identify weaknesses, and work with IT management on improvements to complexity, cost, time, and effectiveness.
Serve as a technical security subject matter resource and provide direction for security-related projects.
Lead, facilitate, analyze, execute, govern, and represent approaches for contracted security assessments, and drive remediation with internal and external stakeholders.
Participate in assessing potential threats and risks to County systems and managing those risks.
Balance business needs against security concerns, explain issues, and recommend options.
Participate in designing, developing, and delivering security training programs and classes.
Perform other duties as assigned.
Maintain regular attendance according to the management-approved work schedule.