Information Security Officer

State of Connecticut•Middletown, CT

4d•Hybrid

About The Position

The State of Connecticut, Department of Administrative Services (DAS), Bureau of Information Technology Solutions (BITS) Statewide Cybersecurity Operations team is seeking to hire an Information Security Officer (Information Technology Analyst 3) with enterprise-wide responsibility and a focus on the Department of Mental Health and Addiction Services (DMHAS). This position leads the maturation and scaling of statewide security platforms, tools, practices, and expertise into DMHAS. It acts as DMHAS's system security officer of record (principal advisor on technical and administrative matters involving the security of DMHAS's information systems) while embedded within DMHAS IT and working in close, ongoing coordination with the Statewide Cybersecurity team.

Requirements

Seven (7) years of experience in information technology (IT) operations, programming, systems/software development or another IT-related field.
One (1) year of the General Experience must have been at the full professional working level with responsibility for performing a full range of complex technical support functions in such areas as: assisting in the design, implementation and management of a major communications network; providing technical and administrative support for a wide area network (WAN) or mini-computer system; assisting in the installation and maintenance of major sub-systems or installing and maintaining other host and/or network software; participating in the design and development of system applications; serving as a project coordinator responsible for coordinating the design, development, programming and implementation of moderately complex information systems projects; performing any closely related complex technical support function.
Considerable knowledge of principles and techniques of systems analysis, design, development, and computer programming.
Principles of information systems.
Principles and theories of business and planning functions.
Programming languages.
Project management principles and techniques.
Principles, problems and techniques of data processing and data communication operations.
Data processing and data communications equipment and diagnostic tools.
Methods and procedures used to conduct detailed analysis and design of computer systems.
Principles of complex computer operating systems.
Knowledge of principles and techniques of business information systems re-engineering.
Network protocols and architecture.
Practices and issues of systems security and disaster recovery.
Applications systems development principles and techniques.
Principles and practices of database management.
Considerable interpersonal skills.
Oral and written communication skills.
Skill in problem solving.
Skill in technical problem solving.
Skill in analysis.
Considerable ability to prepare correspondence, manuals, reports and documentation.
Analyze and resolve operational and communications problems.
Analyze and debug complex software programs.
Identify, analyze and resolve complex business and technical problems.
Supervisory ability.

Nice To Haves

Bachelor’s degree in information technology, Computer Science, or Cybersecurity.
Technical security certification, including Open Web Application Security Project, Azure Security Engineer, or Global Information Assurance Certification.
Experience working in a Health Insurance Portability and Accountability Act (HIPPA) environment.
Experience developing, improving, and coordinating information security program elements across cross-functional teams.
Experience leading full lifecycle incident response and breach coordination for regulated compliance driven environments.

Responsibilities

Serve as DMHAS's embedded partner to the Statewide Cybersecurity team, ensuring DMHAS tooling, architecture, and practices align to enterprise security standards.
Lead adoption, configuration, and maturation of statewide-deployed security platforms (endpoint detection and response, SIEM/SOAR, vulnerability management, and others) within DMHAS.
Assess DMHAS's security program against statewide maturity benchmarks and execute roadmaps to close identified gaps.
Build internal DMHAS security capability, including documentation, repeatable practices, staff expertise reducing reliance on ad-hoc knowledge.
Act as DMHAS's system security officer of record and principal advisor on technical and administrative security matters.
Maintain DMHAS compliance with the HIPAA Security Rule and 42 CFR Part 2 confidentiality requirements for substance use disorder treatment records.
Work to align DHMAS policy & governance controls to statewide Cybersecurity Policies, identify gaps or opportunities, maintain compliance consistent with NIST standards, HHS guidance, and statewide policy.
Lead DHMAS incident tracking, response and reporting, coordinating with the Statewide Cybersecurity team on enterprise-level incidents.
Prepare and represent DMHAS in audits, regulatory inquiries, and statewide security reviews.
Design and deliver security and privacy training and awareness programs for DMHAS staff, including PHI/HIPAA-specific new-employees.
Other duties as identified by Statewide Cybersecurity team.
Although exceptionally rare, on-call may be required, such as extended hours and some weekends.
Diagnoses host system problems and develops and coordinates resolutions.
Manages planning, analysis, design, selection, installation and implementation of new technologies.
Evaluates new technologies.
Tests and evaluates new hardware and/or software.
Makes recommendations for hardware and/or software purchases.
Determines interface and utility requirements and creates design specifications.
Acts as liaison to hardware and/or software vendors, system developers, programmers and management.
Develops and implements network and system security guidelines.
Makes recommendations for migration and upgrade directions.
Trains operators, systems developers and users on new procedures.
Conducts system performance analysis, tuning or storage management.
Conducts technical training programs for IT staff.
Acts as project coordinator overseeing other technical staff and support personnel.
Plans, coordinates and directs multiple projects of assigned staff.
Reviews work of assigned personnel.
Calculates project time and cost estimates.
Prepares necessary procedural specifications to meet design requirements.
Arranges necessary hardware and software availability.
Oversees hardware and software vendors.
Manages project budgets and schedules.
Reviews work of assigned Information Technology Analysts and serves as consultant and/or troubleshooter.
Reviews documentation work of assigned staff.
Communicates with business owners and management.
Facilitates meetings.
Assists in the development of information technology policies, procedures and standards.
Participates in Request for Proposal (RFP) process.
Implements disaster recovery plans, assists in determining critical applications and personnel, or ensures offsite backups.
Defines data flow.
Performs related duties as required.
Performs the most complex duties related to application development.
Develops and implements system programming standards.
Configures and installs host-based application packages.
Maintains host operating systems.
Installs and upgrades host and/or Front End Processor (FEP) operating system software.
Designs and implements complex communications networks.
Diagnoses and resolves problems using network management systems and utilities.
Develops, tests and maintains agency disaster recovery plans designed to restore IT system operability.
Develops processes and procedures in support of IT Business Continuity Planning.
Conducts platform recoverability assessments and Business Impact Analysis (BIA) to determine and assess the impacts associated with disruptions to business functions.
Conducts risk analysis of IT environments by assessing administrative, technical and physical safeguards.
Performs IT investigations to include maintaining chain of custody procedures.
Performs forensics and documents detailed reports of findings.