Manager Information Technology Services 2 Information Security - 11291

The New York State Office of Information Technology Services (ITS) provides operational support 24 hours a day, 7 days a week, 365 days of the year, supporting more than 4,900 applications for 53 New York State Agencies.

Within the Office of Information Technology Services (ITS)/Chief Technology Office (CTO)/Shared Delivery Services/Data Center Networks (DCN), Network Security group, the Manager Information Technology Services 2 Information Security, SG-29, will serve as lead network security manager and subject matter expert overseeing the teams responsible for managing all network security aspects of New York State (NYS) ITS voice and data networks, both on premises and Cloud (52 agencies; 135,000 users).

Specific duties may include, but are not limited to, the following:

• Serve as lead network security manager and subject matter expert overseeing the teams responsible for managing all network security aspects of NYS ITS voice and data networks, both on premises and Cloud (52 agencies; 135,000 users):
• F5 Unit – Manages F5’s Application Delivery and Security Platform to deliver high-performance network security in a full-proxy architecture, combining firewalling, DDoS protection, DNS security, and intrusion prevention with quantum-resilience. Core security functions include Full-Proxy Architecture, Web Application Firewall, DDoS Mitigation, SSL/TLS Orchestration, Zero Trust Enforcement, and Hybrid Multi-Cloud Scaling.
• Web Application Firewall Unit – Manages the specialized Layer 7 application-layer defense that filters, monitors, and blocks HTTP and HTTPS traffic between the Internet and a web application to protect backend servers from application-layer attacks.
• Content Filtering Unit – Manages content filtering within the data centers, NYExchange, and within ITS managed Clouds; implements and maintains Layer 7 firewall security policies/profiles to provide appropriate levels of Internet access to agency servers and end users in accordance with agency requests and cybersecurity posture.
• Microsegmentation Unit – Manages the advanced network security method that divides a data center or Cloud environment into distinct, secure zones down to the individual workload, application, or container level.
• Data Center Firewall (Voice/Data) Unit – Manages the full lifecycle of all physical, virtual, and Cloud-based security barriers (firewalls and IPS devices) to protect enterprise assets and ensure secure network connectivity for NYS agencies and their applications; this includes managing firewall security policies/profiles, and Virtual Private Network tunneling between Palo Alto Networks Cloud Next Generation Firewalls on premises (ZEN and Utica) and within the Cloud environments (Microsoft Azure, Amazon Web Services, and Google Cloud Platform). Responsibilities include design, implementation, deployment, operations (monitoring and alerting, patch management, backup and recovery), optimization, ITSM service/change/incident management, maintenance, and decommissioning.
• Serve as primary liaison with the ITS Chief Information Security Office to facilitate enterprise security reviews/audits, employ proactive security measures, and, as necessary, lead remediation efforts to address findings and ensure that network security practices are abiding by vendor's best practices, state/federal requirements, and are as secure as reasonably possible.
• Manage and ensure compliance with ITS, CTO, DCN, and manufacturer policies, procedures, technical and security standards.
• Design and implement on-premises to Cloud connectivity solutions as required by application needs in collaboration with the Chief Information Security Office and network/application/architecture teams.
• Manage the design, deployment, and maintenance of network virtual appliances as needed including Palo Alto PAN-OS with integrations into Cloud Service Provider network infrastructure.
• Manage ITSM Service Requests and Incidents in all aspects of network security in the NYS ITS voice and data networks.
• Facilitate knowledge transfer and technical training for network security staff for all on premises and Cloud technologies.
• Provide expert in-depth analysis on network security performance using tools such as Zenoss, Splunk, Palo Alto Panorama, NfSen, Ixia, Gigastor, Wireshark, etc.
• Manage and lead in the orchestration of multi-discipline technologies for the resolution of complex problems; communicate with technology and business leaders for problem resolution and make recommendations for system enhancements as required.
• Provide 24x7x365 on-call management network support for advanced troubleshooting, escalation, and ticket resolutions on a rotating basis.
• Troubleshoot carrier-class network equipment and end-to-end network connectivity; proficiency in Layer 3 routing required, including Border Gateway Protocol (BGP), Virtual Routing and Forwarding (VRF), route maps, redistribution, Network Address Translation (NAT), subnetting, etc.
• Manage staff responsible for ensuring network availability within the NYS ITS voice and data networks and Cloud environments is maximized by managing Change Control procedures, code upgrades, network monitoring, installations, and troubleshooting complex issues.
• Participate in network performance analysis, training, and capacity planning.
• Participate in DCN’s annual planning for budget Spend Plan IDs (SPIDs) to meet operational needs related to projects, staffing, equipment, and procurement for network security; understanding of all required NYS purchasing and procurement guidelines.
• Occasional travel may be required.
• Perform the full range of supervisory responsibilities.

Minimum Qualifications

Manager Information Technology Services 2 (Information Security)

Non-competitive: Eight years of information technology, cybersecurity, or information assurance experience*, including two years at the supervisory level.

*Substitutions:

A bachelor's or higher-level degree in any field including or supplemented by 15 semester credit hours in computer science or related field substitutes for three years of required experience; any bachelor’s substitutes for two years of required experience.

An associate degree with 15 semester credit hours in computer science or related field may substitute for one year of required experience. Candidates in a bachelor’s degree program with at least 15 semester credit hours in computer science or related field may substitute such credits for one year of required experience.

A master’s degree or higher in computer science or related field substitutes for one year of required experience.

Preferred Qualifications:

• Proven ability to work independently and as a team member
• Proven ability to lead teams and develop network engineers
• Proven analytical, problem solving, organizational, and time management skills
• Good communication (written and oral) and interpersonal skills
• Good organizational, multi-tasking, and time-management skills
• Proficiency in Layer 3 routing including BGP, VRFs, route maps, redistribution, NAT, subnetting, etc.
• Proficiency in Palo Alto PAN-OS including security policies, NAT policies, zones, routing, tunnels, upgrades, logging, and monitoring
• Proficiency in IPSec and MACsec encrypted transport for Cloud connectivity across carrier networks and the Internet
• Proficiency in Domain Name System (DNS) and managing split-brain public/private resolution designs
• Experience working with monitoring and packet capture/analysis tools such as Zenoss, Splunk, Palo Alto Panorama, NfSen, Ixia, Gigastor, Wireshark, etc.
• Networking certifications (CCNA/CCNP, PCNSA/PCNSE, Network+, etc.) are a plus