Manager Information Technology Services ; Information Security), SG

Duties Description

The New York State Department of Financial Services seeks to build an equitable, transparent, and resilient financial system that benefits individuals and supports business. Through engagement, data‑driven regulation and policy, and operational excellence, the Department and its employees are responsible for empowering consumers and protecting them from financial harm; ensuring the health of the entities we regulate; driving economic growth in New York through responsible innovation;

and preserving the stability of the global financial system.

Duties include, but are not limited to, the following:

• Directs and manages implementation of information security and compliance programs;
• Provides direction and guidance to teams with responsibility for developing, deploying, and maintaining information security architecture;
• Directs the development, interpretation, review, and communication of information security policies, procedures, and standards;
• Coordinates the implementation of information security procedures, risk reviews, and remediation activity, monitors information security compliance, recommends improvements to monitor access to information assets and ensure security safeguards are maintained;
• Manages and resolves security threats to agency information systems and information security incident response;
• Directs development and implementation of information security risk analysis and management processes; coordinates vulnerability scanning and analysis to help determine risk and remediation priorities; manages development and maintenance of enterprise risk registers, which includes reporting and tracking remediation efforts;
• Directs the characterization and analysis of network traffic to identify anomalies and potential threats to network resources; determines events that require investigation and response;
• Implements and improves information security incident response plans and reports;
• Develops and implements plans and procedures to ensure business critical services are recovered in disaster efforts;
• Directs investigation of alleged information security violations; coordinates collection, seizure, handling, and analysis of digital evidence; responds to requests for information from investigators;
• May testify in proceedings regarding analytical processes and findings;
  Serves as an information security expert and evaluates systems and contracts for alignment with State policies and standards;
• Reviews contract, service level agreement, memorandum of understanding language, and other documents to verify needs, requirements, and alignment with State policies and standards;
• Provides information security expertise and recommendations to agency executives on a broad range of information security matters;
• Researches laws and regulations that could affect the security controls and classification of information assets;
• Monitors information security trends, tools, and techniques to maintain awareness and evaluate the applicability of the latest information security techniques and tools to agencies’ security programs;
• Develops a multilayered and adaptive approach to counter information security threat environments; represents the agency at internal and external information security meetings;
• Manages staff and resources dedicated to information security programs;
• Collects metrics to measure the efficiency and effectiveness of information security programs;
• Performs the full range of supervisory responsibilities; and
• Other duties as assigned.

• Bachelor’s degree in Information Security, Computer Science, Management of Information Systems, or a related field required. Master’s degree and professional certifications, such as CISSP, preferred.
• Minimum of seven (7) years of experience in a combination of risk management, information security and information technology fields. Experience in a leadership role is preferred. Employment history should demonstrate increasing levels of responsibility.
• Knowledge and understanding of common information security management frameworks, such as NIST 800-53, CIS Controls.
• Excellen…