About the position
The IT Security Manager (ITSM) is responsible for leading the day-to-day operations of securing the Authority's various information systems. Reporting to the Chief Technology Officer (CTO), the ITSM is tasked with providing technical expertise in all areas of network, system, and application security. The ITSM works closely with the various teams in the Information Technology department to ensure that systems and networks are always designed, developed, deployed, and managed with an emphasis on strong, effective security and risk management controls. The ITSM leads the firm's vulnerability management program, manages the annual cybersecurity assessments and penetration tests, and research and reports on emerging threats, to help the firm take pre-emptive risk mitigation steps. The ITSM effectively correlates and analyzes security events within the context of the Authority's unique environment to proactively detect threats and mitigate attacks before they occur. The ITSM will be tasked with compliance of TSA, FAA and NIST 800-53 standards. This included documented cyber security programs, policies and processes, monthly reporting, maturity modeling and development of training program for cyber security staff. Management of the hosted security operations center, which includes contract management, vendor management and the integration of the combined offsite and onsite teams.
Responsibilities
- Create and maintain the enterprise's security architecture design.
- Create and maintain the enterprise's security awareness training program.
- Create and maintain the enterprise's security documents (policies, standards, baselines, guidelines and procedures).
- Manage, document, participate, and oversee Cyber Incident Response Team (CIRT) and incident response program.
- Create and maintain the enterprise's Business Continuity Plan and Disaster Recovery Plan.
- Effectively communicate cyber security details and technical analysis to varied audiences (e.g., IT workers, leadership) within an organization.
- Oversee the development and distribution of actionable strategic, technical, and tactical cyber information and intelligence to non-executive agencies, local governments, and public authorities through weekly, monthly, or ad hoc reports, briefings, and presentations.
- Serve as primary point of contact for an affected agency during a cyber incident.
- Proactively monitor the environment to detect and implement steps to mitigate cyber-attacks before they occur.
- Provides technical expertise regarding security-related concepts to operational teams within the Information Technology Department and the business.
- Review, investigate, and respond to real-time alerts within the environment.
- Review real-time and historical reports for security and/or compliance violations.
- Monitor online security-related resources for new and emerging cyber threats.
- Assess new security technologies to determine potential value for the enterprise.
- Conduct vulnerability assessments of firm systems, networks and vendors.
- Manage systems owned by the Information Security Team.
- Manage vendors that perform security functions for the enterprise.
- Supervise the design and execution of vulnerability assessments, penetration tests and security audits.
- Ensure the enforcement of enterprise security policy and documents.
- Supervise all investigations into problematic activity and provide on-going communication with senior management.
- Administer and audit all systems to ensure security compliance.
- Manage all security department activities and personnel.
- Liaise with cyber security industry experts to maintain knowledge of cyber trends and techniques.
- Utilize incident data to develop new CIRT technical programs and products to improve the cyber maturity posture.
- Perform additional duties and tasks assigned.
Requirements
- A four-year college degree or equivalent industry training and certifications.
- At least six years of experience in a security analyst or related position.
- One or more of the following certifications: CEH, CISM, CompTIA Security+, CISSP, GSEC.
- Experience with managing and securing both on-premises and hosted systems and applications.
- Experience with application and database security.
- Team management experience.
- Must be able to work well in a team atmosphere.
- Must be a self-starter and work well without continual supervision.
- Must be able to pass all background and security clearance checks.
Nice-to-haves
- Working experience with the following technology vendors and products: Splunk, Trend Micro, Palo Alto, Endpoint Central, Darktrace, Qualys, Agile Blue, Tenable, Solar Winds.
- Strong writing skills, as well as the ability to articulate security-related concepts to a broad range of technical and non-technical staff.
- Working experience with creating, implementing, and managing a threat hunting program within a corporate environment.
- Demonstrated experience implementing and/or enforcing security and compliance frameworks such as CSF, NIST, Cobit, and ISO.
