Security Operations Lead

State of Connecticut•Hartford, CT

6d•Hybrid

About The Position

The State of Connecticut Department of Administrative Services (DAS), Bureau of Information Technology Solutions (BITS) is seeking a Security Operations Lead (Information Technology Manager 2) to direct security operations for the Connecticut Executive Branch. BITS is responsible for the state's shared technology services and its enterprise security program, safeguarding the systems and data of Executive Branch employees. This is a hybrid position located in Hartford, CT, working full-time, 40 hours per week, Monday through Friday, from 8:00 AM to 4:30 PM. Availability outside scheduled hours is required for coordinating and responding to declared security incidents.

Requirements

Ten (10) years of experience in computer or network administration, architecture, operations, production control, systems development, information technology analysis and planning.
Two (2) years of the General Experience must have been in a supervisory capacity or one (1) year of the General Experience must have been in a managerial capacity.
College training in computer science, management information systems or a closely related field may be substituted for the General Experience on the basis of fifteen (15) semester hours equalling one half (1/2) year of experience to a maximum of four (4) years for a Bachelor’s degree.
A Master’s degree in computer science, management information systems or a closely related field may be substituted for one (1) additional year of the General Experience.

Nice To Haves

Possession of a current certification issued by Global Information Assurance Certification (GIAC).
Experience supervising a team of five (5) or more employees who perform security operations functions.
Experience working in an operationally focused security role, accountable for the operation of a security operations center.
Experience serving as the incident coordinator for confirmed information security incidents.
Experience working in a digital forensic investigation function.

Responsibilities

Direct the Security Operations Center and its associated technology platforms, including security monitoring, alert triage, and escalation for executive branch agencies.
Manage the operation of the enterprise security information and event management and security orchestration platforms, including data onboarding, platform availability, log source coverage, and day-to-day operation.
Direct the state's response to information security incidents, serving as incident coordinator for confirmed incidents and coordinating with affected agencies, the Connecticut Intelligence Center, and internal and external partners.
Direct digital forensic investigations, including evidence handling and the delivery of findings to legal counsel, human resources, agency leadership, and law enforcement.
Supervise, assign, and evaluate the work of security operations staff and contracted consultants.
Establish and report operational measures for the function, including alert volume, coverage of monitored log sources, and time to detect and contain.
Build and maintain incident response plans, playbooks, and response exercises, coordinated with agency information security officers and, when required, with the Division of Emergency Management and Homeland Security.
Lead the security team’s collaboration with information technology teams to improve identity security, including access reviews, privileged access management, and conditional access design.
Manage vendor and service provider relationships supporting security operations.
Plan the staffing, training, and budget for the function.
Direct response activity across executive branch agencies during a cyber security incident, including coordination of response with staff outside this position’s normal reporting line.
Determine when an incident requires escalation to the Chief Information Security Officer for regulatory notification decisions.
Approve containment actions that may interrupt state systems or service during an active incident.