Director of Cyber Risk Management/Information Security Manager - 20001NYC

ITS provides operational support to state agencies on a 24x7x365 basis; some positions may be required to provide this critical service at any time.

Under the direction of a Deputy Chief Information Security Officer within the Chief Information Security Office (CISO) the incumbent will serve as the Director of the Cyber Risk Management (CRM) bureau, providing oversight of the Vulnerability Management, Threat Response, and Cyber Process Improvement & Metrics sections. The CRM Bureau is responsible for the oversight and operations of a variety of security tools and response functions to help ensure optimal cybersecurity protections, identification and remediation of vulnerabilities, and cyber risk reduction for ITS and its client agencies. The CRM bureau is also responsible for driving process improvement and developing metrics for the CISO division, as well as managing development and oversight of the Government Risk and Compliance (GRC) platform. The incumbent will provide direction and support for all activities and staff within the bureau, as well as subject matter expertise on vulnerability management and response, security program metrics, and process improvement. The incumbent will act as a member of the Chief Information Security Office Leadership Team, helping shape and implement the strategic vision for cyber security within NYS.

The position requires an incumbent to act with a great deal of independence in alignment with agency and upper-level management strategic direction. The position requires communicating orally and in writing with various individuals including management, users, vendors, and other IT staff. The incumbent must be able to communicate clearly with subordinate staff regarding work priorities and performance. The incumbent will have to work with various teams and stakeholders to resolve technically complex and politically sensitive issues under pressure.

The position requires availability during off-shift hours to ensure appropriate response to security incidents or other critical activities that may impact sensitive information, critical systems, NYS agencies, or ITS.

Specific duties include, but are not limited to:

• Lead and direct all the activities within the Cyber Risk Management (CRM) bureau across multiple managers.
• Responsible for the overall vision and direction of the CRM bureau, including the development of strategic plans to revise and improve upon the bureau’s work, drafting staffing plans, and the maintenance and development of charters, product catalogues, RACI charts, and other documentation.
• Oversee the development and maturation of the threat and vulnerability response process, helping CISO to reduce cyber risk by efficiently prioritizing and responding to significant vulnerabilities and emerging cyber threats.
• Oversee the team responsible for the GRC Platform and the CISO SharePoint site, including development, configurations, development, and maintenance through formalized tracking and release management.
• Oversee the development and maturation of the CISO Metrics Program, including collecting and displaying various data points for stakeholders through reports and dashboards.
• Oversee the creation of a vulnerability disclosure program to receive and triage vulnerabilities identified by security researchers.
• Provide guidance on cyber risk management best practices and strategies for risk identification and remediation to support the development and improvement of the agency’s GRC platform.
• Provide leadership, guidance, and subject matter expertise across all teams within CRM.
• Serve as an information security expert and ensure technology contracts adhere to NYS Security Policies and standards and align with the strategic direction of ITS and CISO.
• Monitor and remain aware of information security industry trends, tools, and techniques.
• Ensure that all communications, processes, and teams within CRM are done in consideration of the operational concerns and workloads of peer teams throughout CISO and ITS, and that staff maintain the collaborative attitude and open communications required to successfully carry out the mission of CISO and ITS.
• Evaluate high-impact initiatives, monitor ongoing progress, and execute corrective strategies as needed
• Mentor and supervise staff in the proper performance of their duties.
• Perform additional duties as required.

Minimum Qualifications

Minimum Qualifications

Information Security Manager

Non-competitive: Nine years of information technology, cybersecurity, or information assurance experience*, including three years at the supervisory level or one year at the managerial level

Or

One year of state service as a Manager Information Technology Services 2 (Information Security)

*Substitutions: A bachelor's or higher-level degree in any field including or supplemented by 15 semester credit hours in computer science or related field substitutes for three years of required experience; any bachelor’s substitutes for two years of required experience. An associate degree with 15 semester credit hours in computer science or related field may substitute for one year of required experience. Candidates in a bachelor’s degree program with at least 15 semester credit hours in computer science or related field may substitute such credits for one year of required experience. A master’s degree or higher in computer science or related field substitutes for one year of required experience.

Preferred Qualifications

• Certifications in one or more of the following:

o Cyber Defense (e.g., GCIA, GCIH, GCED, GSOM, GSOC, GMON, GCDA)

o Cyber Threat Intelligence (e.g., GCTI, CTIA, CCIP, GOSI)

o Information Security Management (e.g., CISSP, CISM, CCISO)

• Experience in one or more of the following areas:

o Leading and managing teams

o Technical writing

o Cyber risk management

o Identifying, assessing, prioritizing, and remediating security vulnerabilities

o Managing a vulnerability disclosure program

o Designing, implementing and configuring larger application platforms, such as an enterprise resource planning (ERP) solution

o Development and analysis of KPIs and metrics based on provided requirements

o Process development and continuous improvement

o Information security incident response

• Strong understanding of the foundations of Information Security, such as the CIA triad, information classification, identity and access management, risk management, vulnerability management, secure architecture and engineering, network security, software development security, etc.
• Excellent oral and written communication skills including the ability to clearly articulate information technology and information security concepts to a varied audience to facilitate wide understanding
• Demonstrated critical thinking, problem solving and analytical skills
• Strong capabilities in developing and maintaining positive relationships with shared services teams within CISO and other divisions as required.
• Demonstrated skill in facilitating meetings, listening, and negotiating between multiple stakeholders to drive results