Information Security Officer

Virginia Information Technologies Agency•Richmond, VA

1d•$85,000 - $105,970

About The Position

The Department of Behavioral Health and Developmental Services (DBHDS) is seeking a cybersecurity incident response professional to lead the agency’s incident response program in alignment with VITA procedures, Commonwealth security requirements, and applicable regulations. The position serves as DBHDS’s primary point of contact with VITA and oversees incidents from identification through triage, containment, eradication, recovery, remediation, and closure. It assesses incident severity, business impact, affected systems, data exposure, and risks to agency operations. The role coordinates responses to malware, ransomware, phishing, compromised accounts, unauthorized access, data loss, denial of service events, insider threats, exploited vulnerabilities, and potential PHI breaches. It analyzes security alerts and logs, supports forensic investigations and evidence preservation, maintains chain-of-custody documentation, and assists with root cause analysis. The position also prepares incident documentation, timelines, reports, briefings, and corrective action tracking, and guides agency personnel on incident reporting, escalation, and evidence handling. Additional work includes maintaining incident response policies, procedures, playbooks, and communication processes; coordinating quarterly tabletop exercises in accordance with SEC 530; and supporting audits, assessments, FOIA requests, subpoenas, investigations, and ServiceNow ticketing. The position provides 24/7 on-call support for urgent incidents and collaborates with infrastructure, identity, vulnerability management, applications, business units, CSBs, vendors, and VITA on continuity planning, disaster recovery testing, cyber resilience, post-incident reviews, compliance, and ongoing improvement of DBHDS’s incident response capabilities. The position is based at the DBHDS Central Office. Telework may be available but is not guaranteed and must be approved under Commonwealth policy.

Requirements

Experience leading or coordinating cybersecurity incident response in an enterprise, government, healthcare, or public sector environment.
Knowledge of the cybersecurity incident lifecycle, including identification, triage, containment, eradication, recovery, and closure.
Experience responding to major incident types such as ransomware, phishing, compromised accounts, unauthorized access, data loss, DDoS, insider threats, and PHI/PII breaches.
Ability to analyze and interpret security alerts, logs, endpoint and network activity, vulnerability data, and threat intelligence.
Experience supporting forensic investigations, evidence preservation, chain-of-custody processes, and root cause analysis.
Ability to prepare accurate documentation, incident reports, timelines, executive briefings, and corrective action tracking.
Strong communication, analytical, organizational, and judgment skills.
Ability to work effectively under pressure and protect confidential information.

Nice To Haves

Experience working within Virginia state government, VITA, or another centralized public sector cybersecurity organization.
Professional certifications such as CISSP, CISM, Security+, CySA+, GCIH, GCIA, or GCFA.
Experience in environments handling PHI or sensitive client information, such as healthcare, behavioral health, or human services.
Familiarity with Commonwealth security standards, SEC 530 requirements, NIST guidance, or similar frameworks.

Responsibilities

Lead the agency’s incident response program in alignment with VITA procedures, Commonwealth security requirements, and applicable regulations.
Serve as DBHDS’s primary point of contact with VITA for cybersecurity incidents.
Oversee incidents from identification through triage, containment, eradication, recovery, remediation, and closure.
Assess incident severity, business impact, affected systems, data exposure, and risks to agency operations.
Coordinate responses to malware, ransomware, phishing, compromised accounts, unauthorized access, data loss, denial of service events, insider threats, exploited vulnerabilities, and potential PHI breaches.
Analyze security alerts and logs.
Support forensic investigations and evidence preservation, maintain chain-of-custody documentation, and assist with root cause analysis.
Prepare incident documentation, timelines, reports, briefings, and corrective action tracking.
Guide agency personnel on incident reporting, escalation, and evidence handling.
Maintain incident response policies, procedures, playbooks, and communication processes.
Coordinate quarterly tabletop exercises in accordance with SEC 530.
Support audits, assessments, FOIA requests, subpoenas, investigations, and ServiceNow ticketing.
Provide 24/7 on-call support for urgent incidents.
Collaborate with infrastructure, identity, vulnerability management, applications, business units, CSBs, vendors, and VITA on continuity planning, disaster recovery testing, cyber resilience activities, post-incident reviews, compliance efforts, and continuous improvement of incident response capabilities.