Information Security Officer - Information Technology Services

BASIC FUNCTION

Under the direction of a designated administrator, the Information Security Officer develops and implements procedures, policies, strategies, and standards in the management of the College's IT security program and controls. Assesses and recommends strategies to address IT-related risks, threats, and other identified operational deficiencies; develops, coordinates, and leads incident response activities; develops campus-wide IT security plans; monitors systems and ensures compliance with relevant regulatory requirements and standards;

and fosters an IT compliance-focused campus culture through end‑user education programs. Supervises assigned staff and/or teams.

• Collaborates with the College's academic and administrative units and relevant ITS support teams to facilitate IT risk assessments.
• Implements risk management processes and best practices.
• Identifies location, type, sensitivity, ownership, and access requirements for data being used by the College.
• Establishes controls and standards in consultation with supervisor, division/department personnel, and other key constituencies as appropriate.
• Monitors the external IT environment for emerging threats.
• Effectively configures and utilizes available systems, alerts, and other sources of information to identify and address security threats and events. Advises supervisor on appropriate course of action. Documents risk analysis of security threats for management review.
• Researches, evaluates, and recommends appropriate IT security systems, technology, controls, and solutions (e.g., firewalls, intrusion detection/prevention, and vulnerability scanners). Provides detailed pros and cons, build vs. buy analyses of options. Ensures plans and designs consider security controls, performance, confidentiality, scalability, access, cost, etc.
• Oversees the implementation of security testing projects and other system plans. Validates project adherence to District policies and standards. Ensures regulatory compliance through thorough testing, assessment, and remediation prior to full implementation.
• Develops, implements, and manages College-wide IT security incident response processes and procedures. Leads the investigation, coordination, resolution, and closure on security incidents as they are escalated or identified. Generates fact-based reports. Documents incident response processes/protocols and updates as needed.
• Develops, implements, and maintains a College-wide IT security plan and obtains plan sign-off from key stakeholders and constituencies, as appropriate. Executes a plan that ensures the integrity and confidentiality of information residing in College workstations, servers, mobile devices, and related computer peripherals.
• Maintains an in-depth technical documentation repository of College systems, networks, and core applications.
• Leads the planning, testing, and tracking of periodic, College-wide IT security audits. Identifies security gaps and deficiencies through risk assessments and recommends corrective action of identified vulnerabilities and weaknesses. Ensures requisite compliance monitoring is in place to expeditiously identify control weaknesses, compliance breaches, misuse trends, and/or operational loss events.
• Serves as a subject matter expert on District strategies for information security processes. Ensures implemented processes align to regulatory Federal, State, and industry requirements and District policies.
• Leads the review and formal approval process for policy and procedural updates to meet or exceed industry standards, compliance requirements, and end‑user expectations.
• Develops, implements, and manages a College-wide IT security awareness and training program that fosters a risk and compliance-focused culture. Ensures training programs align information security activities with regulatory requirements and internal risk management policies. Provides regular guidance, resources, and advocacy on current best practices for information security.
• Assists with the development and implementation of business continuity and disaster recovery plans to ensure comprehensive information security and mitigation of…