Security Operations Lead

The State of Connecticut Department of Administrative Services (DAS), Bureau of Information Technology Solutions (BITS) is currently accepting applications for an anticipated Security Operations Lead (Information Technology Manager
2) to direct security operations for the Connecticut Executive Branch. BITS runs the state's shared technology services and its enterprise security program, protecting the systems and data of Executive Branch employees.

Our State Employee Benefits Overview page! Professional growth and development opportunities. A healthy work/life balance to all employees.

• Hybrid.
• Monday-Friday.
• Location:
  
  Hartford, CT.
• Full Time, 40 hours/week.
• First Shift, 8:00 AM to 4:30 PM.
• The position requires availability outside scheduled hours when needed to coordinate and respond to a declared security incident.

The Security Operations Lead (Information Technology Manager
2) reports to the state Chief Information Security Officer and leads the Security Operations function, including the virtual Security Operations Center, the security information and event management and security orchestration platforms, Endpoint Detection and Response (EDR), security incident response, digital forensics, and others. The position supervises a team of security operations staff. Under the State Response Framework, the role supports cyber incident planning, response, and recovery for state government under Emergency Support Function 17 (ESF-17).

The Security Operations Lead can expect to:

• Direct the Security Operations Center and its associated technology platforms, including security monitoring, alert triage, and escalation for executive branch agencies.
• Manage the operation of the enterprise security information and event management and security orchestration platforms, including data onboarding, platform availability, log source coverage, and day‑to‑day operation.
• Direct the state's response to information security incidents, serving as incident coordinator for confirmed incidents and coordinating with affected agencies, the Connecticut Intelligence Center, and internal and external partners.
• Direct digital forensic investigations, including evidence handling and the delivery of findings to legal counsel, human resources, agency leadership, and law enforcement.
• Supervise, assign, and evaluate the work of security operations staff and contracted consultants.
• Establish and report operational measures for the function, including alert volume, coverage of monitored log sources, and time to detect and contain.
• Build and maintain incident response plans, playbooks, and response exercises, coordinated with agency information security officers and, when required, with the Division of Emergency Management and Homeland Security.
• Lead the security team’s collaboration with information technology teams to improve identity security, including access reviews, privileged access management, and conditional access design.
• Manage vendor and service provider relationships supporting security operations.
• Plan the staffing, training, and budget for the function.
• Direct response activity across executive branch agencies during a cyber security incident, including coordination of response with staff outside this position’s normal reporting line.
• Determine when an incident requires escalation to the Chief Information Security Officer for regulatory notification decisions.
• Approve containment actions that may interrupt state systems or service during an active incident.

DAS provides timely and cost-effective services to state agencies, state employees, municipalities, private industry, and the public. DAS offers a diverse array of programs, encompassing statewide human…