Lead, Cybersecurity Operations -Information Technologies

Description

The Information Technologies is currently seeking a Full-time Regular Lead, Cybersecurity Operations.

The Security Operations team is responsible for the planning and implementation of security measures designed to protect the staff, capital assets, and proprietary information of the University by providing strategic direction, tactical management, emergency planning, and advisory services. The IT Security team provides leadership and technical guidance to both IT and Client departments on the identification and mitigation of risk. In addition, this team is the primary responder to any issue that may lead to disruptions within the organization as such they are responsible for creating and implementing processes and solutions for the detecting, investigating and mitigation of security incidents that could impact the University.

The position reports to the Manager, Cybersecurity Operations. The position works 35 hours per week, with normal business hours being 8:30 - 4:30, Monday to Friday. The position is subject to high stress and requires balancing multiple priorities with tight deadlines. There may be a requirement for after-hours work, depending on the nature of the projects, operations, and initiatives currently underway.

(job functions include but are not limited to):

Requirements Gathering

• Work with customers, IT Partners, Project Managers, and representatives from various faculties/departments on campus to understand cyber security requirements or issues
• Researching and defining cyber security operating procedures

Project Management/Leadership

• Work with the leadership team to build annual goals and objectives for themselves and their staff
• Full managerial discretion for direct reports including recruitment, onboarding, professional development, coaching, up to and including discipline and termination
• Lead as an escalation point and organize the team through challenging cybersecurity events with the goal of root cause determination and build a remediation plan to resolve issues
• Work with the architecture or project teams to build tasks, and track the work required for the security items on projects to ensure timely completion of deliverables from their team
• Ensure all systems are aligned with the IT's standards and roadmaps
• Actively participate in assigned projects delivering consulting, installation and support services
• Contribute to the success of project deployment in cyber security operations
• Organize and lead vulnerability management and incident response processes
• Operational upgrades coordination and implementation for security operational products
• Lifecycle management of hardware and software assets
• Oversight of managed security services providers
• Provides briefings to leadership on major new technologies, issues, and changes that impact cyber risks
• Planning for future technology shifts and upgrades
• Support security architecture practices related to cyber security operational technology including but not limited to vulnerability management, incident response, IDS/IPS, SIEM, network topology, network security, Operating system security, identity and access management, etc
• Managing licensing related to functional area of responsibility
• Work independently with guidance to plan projects, solve problems and prioritize competing tasks for themselves and direct reports
• Ability to identify and generate executive summaries on key performance indicators for Security Operations activities
• Participate in on-site network and security audits related to PCI, SOX, etc. for effective vulnerability, security event and incident management

Documentation

• Responsible for ensuring all documentation is detailed, accurate, timely, and meets the requirements of the project stakeholders and operational excellence. These documents may include, but are not limited to:
  • Consolidated design, showing both logical and physical layout
  • Security vulnerability management SOPs
  • Standard operating procedures for daily activities
  • Security security application setup and configuration
  • Service catalog request items
  • Security Incident handling and tracking
  • Release documentation
  • Support documentation, FAQs, known issues, errors
  • Requests for Change
  • CMDB add/change/remove data
• Develop and train others on technical documentation, standards and guidelines

Technical Leadership

• Administer and provide technical support for primarily vulnerability management and incident response, could also manage SIEM, PAM, other security tools for forensics, etc
• Design and develop new technologies that align with vendor roadmaps or future trends in the industry that apply to the server infrastructure environment
• Lead the cyber security process using their own technical expertise and challenge the team members on their technical recommendations where needed and appropriate
• Lead technology roadmap sessions and work with IT Architecture to develop new standards to drive innovation in the cyber security service realm
• Take on responsibility for self-study and…