Security And Privacy Officer

State of Maryland•Baltimore City, MD

2d•Onsite

About The Position

The Security and Privacy Officer (Administrative Program Manager IV) serves as the Maryland Department of Juvenile Services’ dedicated cybersecurity and privacy lead. Reporting directly to the Chief Information Officer (CIO), the position provides day-to-day security engagement with DJS infrastructure, platforms, and internal operations. The role functions as DJS’s empowered Information Security Officer and designated Agency Privacy Officer (APO), ensuring the department meets its cybersecurity and privacy obligations while supporting the DJS privacy risk management framework. The position is the primary day-to-day cybersecurity contact for DJS divisions and provides security guidance, risk advisories, and operational support. It conducts security assessments, reviews projects and procurements for security requirements, monitors and reports on security posture and remediation progress, and coordinates with the Office of Security Management (OSM) on centralized cybersecurity services. As APO, the position develops and maintains DJS-specific privacy policies and standards, conducts Privacy Impact Assessments, coordinates privacy incident response and breach notification obligations, and advises leadership on data minimization, retention, and disposal. The role also manages cybersecurity compliance and risk activities, maintains a DJS-specific risk register, coordinates remediation and audit responses, participates in statewide governance, and supports the CIO with security and privacy analysis and executive reporting. Other duties may be assigned by the CIO.

Requirements

Five years of professional experience performing information security, cybersecurity risk assessment, security compliance monitoring, privacy risk management, or information technology risk and compliance activities.
A bachelor’s degree from an accredited college or university in information technology, cybersecurity, computer science, information systems, or a closely related field may substitute for three years of the required experience.

Nice To Haves

Experience applying cybersecurity frameworks and standards to security assessments, risk mitigation, and compliance activities, preferably in a public-sector or government environment.
Experience supporting or implementing privacy program activities, including privacy assessments, privacy incident response, data protection practices, or developing and maintaining privacy policies and procedures.
Relevant professional certifications or specialized training in cybersecurity, information security, privacy, or risk management.

Responsibilities

Serve as the primary day-to-day cybersecurity point of contact for DJS divisions, providing security guidance, risk advisories, and operational support.
Conduct security assessments of systems, infrastructure, and applications.
Review projects and procurements for security requirements.
Monitor security metrics and report on security posture, incident trends, and remediation progress.
Coordinate with OSM’s Cyber Technology Directorate to support adoption and effective use of centralized cybersecurity platforms and services.
Serve as the Department’s designated Agency Privacy Officer (APO).
Develop and maintain DJS-specific privacy policies, procedures, and standards aligned with statewide frameworks.
Conduct Privacy Impact Assessments for systems, applications, and data use and sharing arrangements involving personally identifiable information or personal information.
Coordinate privacy incident response and breach notification obligations.
Advise leadership on data minimization, retention, and disposal practices.
Manage DJS cybersecurity compliance with applicable frameworks and statewide security policies.
Maintain a DJS-specific risk register and track risk treatment plans and remediation timelines in coordination with OSM’s Governance, Risk, and Compliance functions.
Report risk and compliance status to the State CISO.
Align internal compliance activities with statewide audit and assessment cycles and coordinate responses to cybersecurity and privacy findings.
Maintain clear accountability between this position’s cybersecurity and privacy compliance responsibilities and the DJS Compliance Officer’s IT, financial, and performance compliance responsibilities.
Represent DJS on statewide governance boards, such as the Cyber Security Coordinating Council.
Collaborate with OSM directorates and integrate DJS-specific security and privacy activities into the statewide program.
Support the CIO with analysis, briefing materials, and situational awareness on security and privacy matters for executive leadership reporting.
Perform other duties as assigned by the Chief Information Officer.