Information Technology Specialist Information Security

Description

ITS provides operational support to state agencies on a 24x7x365 basis; some positions may be required to provide this critical service at any time.

Under the support of a Manager Information Technology Services 1 or 2 (Information Security), the Information Technology Specialist 3 (Information Security), SG-23 will support the day‑to‑day operations of an information security unit for a dedicated agency to support the confidentiality, integrity, and availability of the agency’s information assets.

The position requires availability during off‑shift hours to ensure appropriate response to security incidents or other critical activities that may impact sensitive information, critical systems, NYS agencies, or ITS.

Specific Duties Include, But Are Not Limited To

• Assist with the implementation of information security and compliance programs.
• Evaluate and resolve security threats to agency information systems.
• Serve as an information security provider for the Dedicated Support Team and provide recommendations on system and contract alignment with agency and State information security policies.
• As needed, participate in meetings and communicate agency needs and expectations with agency stakeholders, Chief Technology Office (CTO) representatives, and team members.
• Maintain familiarity with each client agency’s business functions and requirements.
• Assist each agency in complying with NYS information security policies and standards, protocols, cybersecurity best‑practices, and regulatory requirements related to cybersecurity.
• Assist each agency in evaluating, understanding, and appropriately managing information security risks.
• Respond to incidents that pose a security risk.
• Assist with advising agency on security considerations related to procurement of products and services.
• Support each agency in maintaining information classification for IT systems and solutions and data sets in alignment with NYS policy.
• Ensure security engineering and architecture considerations are addressed in services and systems designs.
• Pursuant to approved protocols and processes, disseminate threat information to support ITS teams and agencies.
• Respond to security incidents, including investigating attacks and breaches.
• Analyze threats and compliance requirements, advise management, and develop plans for risk mitigation and compliance. Pursuant to approved protocols and processes, elevate security concerns and report incidents to the applicable entities for review and action in an appropriate manner.
• Promote and contribute to the development of information security awareness and programs to benefit the agencies.
• Contribute to the development of NYS policies and standards.
• Maintain an adequate level of current knowledge and proficiency in information security through annual Continuing Professional Education (CPE) credits directly related to information security.
• Assist with project security for ITS and supported agency projects and initiatives.
• Monitor and remain aware of information security industry trends, tools, and techniques.
• Perform additional duties as required.

Minimum Qualifications

• Non‑competitive: five years of information technology, cybersecurity or information assurance experience.
• Substitutions: a bachelor’s or higher‑level degree in any field; 15 semester credit hours in computer science or a related field substitute for three years of required experience; any bachelor’s substitutes for two years; an associate degree with 15 semester credit hours substitutes for one year; a master’s degree or higher substitutes for one year.

Preferred Qualifications

• Applicable information security certificates such as CISSP, CISM, etc.
• Experience in one or more of the following areas:
• applying network, system or application security
• security policy/standard/guideline development, implementation or interpretation
• conducting risk assessments and evaluating information technology systems for security controls (SSDLC)
• information security incident response
• excellent oral and written communication skills including the ability to clearly articulate information technology and information security concepts to a varied…