2627 Behavior and Academic Support Aide Day to Day 20hour

Blackstone Valley Prep Mayoral Academy; Harrisburg (Dauphin County); Hybrid; USD 138,000 - 169,000; Full time

Job summary

PHEAA is seeking a strategic Enterprise Security leader to plan, develop, and operate robust information security and privacy programs across the Agency. You will partner with executive leadership to safeguard digital assets and ensure compliance with applicable laws and policies.

The role oversees security and privacy strategy, risk management, staff development, and incident response, while guiding enterprise projects and budget decisions in a hybrid work environment at the Harrisburg

Qualifications

• Experience leading security programs and teams.
• Experience implementing privacy and data protection controls.
• Strong leadership, communication, and stakeholder management.
• Certified Information Security Management (CISM) or CISSP designation or equivalent experience.

Responsibilities

• Lead enterprise security program planning and governance.
• Oversee privacy and security policy development and compliance.
• Manage security budget and staffing.
• Translate risk to executive leadership and Board.
• Respond to incidents and oversee SOC activities.

Skills

Leadership

Information security

Risk management

Strategic planning

Policy development

Education

Bachelor's degree in information security, computer science, or related field

Job description

PHEAA is a nonprofit student aid organization that holds a mission of providing affordable access to higher education.

Give back tomorrow by joining us today!

Salary

Grade 20, Commensurate with experience starting at $153,222.00

Shift

Monday through Friday 8:00 AM - 5:00 PM - Hybrid 2 days a week onsite

Location

PHEAA Headquarters 1200 North 7th Street, Harrisburg, PA 17102

Department

Enterprise Security Office

JOB PURPOSE AND SUMMARY

This role is responsible for planning, developing, and operating reliable information security and privacy programs that support the integrity and availability of digital information, safeguards the Agency’s digital assets, and implements effective and appropriately scaled security and privacy policies, practices, and technologies. Develop relationships with all levels of the organization to implement appropriate security and privacy standards and procedures. This position is responsible for monitoring compliance with the legislated requirements that impact information security and privacy for PHEAA in its roles as an independent state agency and a commercial enterprise.

PRIMARY DUTIES AND RESPONSIBILITIES

Security Leadership

• Build an enterprise-wide cybersecurity culture that improves security awareness and instills a risk-aware culture in the Agency.
• Develop, manage and set the vision, goals, and priorities for information security at PHEAA.
• Advise and report to Agency executive leadership and Board as may be required or requested on current Agency cybersecurity strategy and cybersecurity risk.
• Lead initiatives related to Information Security strategic planning.
• Provide strategic oversight for the security execution of enterprise projects, initiatives, and organizational changes, ensuring effective leadership and alignment across security managers, team leads, and staff.
• Drive and oversee execution of security projects and initiatives, empowering security managers, team leads, and staff.
• Set and manage the budget for the Enterprise Security Office.
• Consult with business and Information Technology stake holders to understand their business and technical plans and formulate an Information Security plan that allows the Agency to achieve its goals.
• Define Information Security metrics and report them regularly as required by Agency processes.
• Stay current on emerging technology, trends, legislation, and threats that impact the Agency’s information security posture.

Information Security and Privacy Management

• Lead the development and maintenance of the Agency’s strategic cyber-security roadmap.
• Oversee the development, implementation, and management of security strategy processes, along with related architecture and engineering standards.
• Assist in the review of applications and technology environments during the development and acquisitions process.
• Translate and interpret technical risks for a broad range of audiences including the Board and Executive Leadership.
• Maintain current knowledge of applicable cyber-security and privacy laws and monitor advancements in information security and privacy to ensure Agency adaptation and compliance.
• Define and drive compliance with the Agency’s enterprise security and privacy policies and standards, and ensure the related controls are in place and operating effectively.

Security Risk Management

• Lead the development and implementation of the information security policy, standards, guidelines, and procedures that balance business objectives with information security risk.
• Identify protection goals, objectives, and metrics consistent with Agency goals and regulatory requirements.
• Collaborate with stakeholders to gain alignment on the determination on acceptable levels of risk.
• Prioritize security initiatives and spending aligned with overall Agency risk management and financial goals.
• Identify requirements and oversee development of Agency cyber-security training.

Staff Management

• Responsible for leading the Enterprise Security Office team in fulfilling the mission of the Agency’s information security goals.
• Develop and enhance employee competence and effectiveness by providing on-going guidance, mentoring, feedback, and motivation to staff.
• Create a culture that fully engages employees and empowers others to suggest and make decisions for continuous improvement.
• Responsible for assisting recruiting with attracting key talent.
• Responsible for employee lifecycle including hiring, providing periodic feedback on performance including writing and delivering annual performance evaluations, promotions, and terminations.
• Ensure that ESO has the appropriate tools and resources necessary to accomplish their assigned tasks.
• Identify skill development needs and develop training programs.

Incident Response

• Provide strategic vision and tactical execution for cybersecurity incident prevention, detection, and response
• Oversee incident response planning as well as the investigation of security breaches and assist with disciplinary and legal matters associated with such breaches as necessary.
• Set the strategy for the continuous monitoring and protection information systems including oversight of the Agency’s Security Operations Center.
• Evaluate suspected security breaches and recommend corrective actions (including incidents involving outside vendors).
• Advise Executive Leadership during incidents as part of the Agency’s Critical Incident Management team.

OTHER DUTIES AND RESPONSIBILITIES

• Collaborate with internal and external auditors as appropriate for independent security audits.
• Support Information Technology goals by providing leadership and guidance as directed over Information Technology roles not traditionally part of the Enterprise Security Office as well as provide strategic architectural guidance on cross functional solutions.
• Other duties as assigned.

Required Skills

• Bachelor's degree required in information security, computer science, or related field; experience of ten years in information/physical security, information technology, or risk management related field; and minimum of five years managing network, infrastructure or security staff or roles; or any equivalent combination of experience, training, and/or certification(s).
• Experience implementing controls and mitigating risks related to information security and data privacy standards
• Experience implementing cloud and other modern security technologies include encryption, network security, intrusion detection, and digital forensics
• Experience with IT Risk Management, Information Security, IT control assurance in a central or business aligned support/control/audit functions.
• Strong leadership, communication, and people management skills.
• Demonstrated integrity and ability to maintain principles under internal and/or external pressure.
• High-quality analytical skills, management experience, and exceptional relationship management competencies.
• Demonstrated qualitative experience in strategic planning and/or policy development at a senior level.
• Effectiveness in communicating recommended courses of action for innovative, business- oriented responses.
• Passion for excellence and a demonstrable orientation toward successful staff development.
• Must be an intelligent, articulate and persuasive leader who can serve as an effective member of the senior management team and who is able to communicate security-related concepts to a broad range of technical and non-technical staff.
• Proven experience with business continuity and disaster recovery planning, auditing, and risk management, as well as contract and vendor negotiation.
• Knowledge and experience in information privacy laws, access, release of information, and release control technologies.
• Certified Information Security Management (CISM), Certified Information Systems Security Professional (CISSP) designation or relevant long-term experience required.

Qualifications:

• Bachelor's degree required in information security, computer science, or related field; experience of ten years in information/physical security, information technology, or risk management related field; and minimum of five years managing network, infrastructure or security staff or roles; or any equivalent combination of experience, training, and/or certification(s).
• Experience implementing controls and mitigating risks related to information security and data privacy standards
• Experience implementing cloud and other modern security technologies include encryption, network security, intrusion detection, and digital forensics
• Experience with IT Risk Management, Information Security, IT control assurance in a central or business aligned support/control/audit functions.
• Strong leadership, communication, and people management skills.
• Demonstrated integrity and ability to maintain principles under internal and/or external pressure.
• High-quality analytical skills, management experience, and exceptional relationship management competencies.
• Demonstrated qualitative experience in strategic planning and/or policy development at a senior level.
• Effectiveness in communicating recommended courses of action for innovative, business- oriented responses.
• Passion for excellence and a demonstrable orientation toward successful staff development.
• Must be an intelligent, articulate and persuasive leader who can serve as an effective member of the senior management team and who is able to communicate security-related concepts to a broad range of technical and non-technical staff.
• Proven experience with business continuity and disaster recovery planning, auditing, and risk management, as well as contract and vendor negotiation.
• Knowledge and experience in information privacy laws, access, release of information, and release control technologies.
• Certified Information Security Management (CISM), Certified Information Systems Security Professional (CISSP) designation or relevant long-term experience required.

Required Experience

Bachelor's degree required in information security, computer science, or related field; experience of ten years in information/physical security, information technology, or risk management related field; and minimum of five years managing network, infrastructure or security staff or roles; or any equivalent combination of experience, training, and/or certification(s).

Essential Duties AND Responsibilities

Physical Requirements and Work Environment

• Perform work required for this position in an office environment and/or via remote or hybrid arrangement.
• Available 24/7 as needed.
• Remain sedentary for moderate periods of time.
• Must be able to communicate both written and verbal (i.e. speak in front of groups of people, email, editing and discussing contracts, etc.).
• Must be able to use a personal computer.
• Must be able to conduct detailed research.
• Must be able to perform basic math skills.
• Must be able to have regular and predictable on-site attendance; highly interactive role.

ADDITIONAL KNOWLEDGE, SKILLS, AND ABILITIES

• Use logic and reasoning to identify the strengths and weaknesses of alternative solutions, conclusions or approaches to problems and make recommendations.
• Ability to prioritize multiple, competing assignments at one time and work independently
• Ability to develop a highly effective team
• Strong influencing skills
• Exceptional written and oral communications skills
• Ability to build sustainable competitive advantages through pragmatic, innovative security solutions.
• Ability to anticipate, influence, and assist the organization to assess and rapidly adjust to changing conditions and trends (internal and external) of importance to the direction of the organization.

PHEAA’s environment welcomes and supports our employees, customers, and stakeholders; we seek out and value differing perspectives and contributions.

Essential Duties AND Responsibilities

Physical Requirements and Work Environment

• Perform work required for this position in an office environment and/or via remote or hybrid arrangement.
• Available 24/7 as needed.
• Remain sedentary for moderate periods of time.
• Must be able to communicate both written and verbal (i.e. speak in front of groups of people, email, editing and discussing contracts, etc.).
• Must be able to use a personal computer.
• Must be able to conduct detailed research.
• Must be able to perform basic math skills.
• Must be able to have regular and predictable on-site attendance; highly interactive role.

ADDITIONAL KNOWLEDGE, SKILLS, AND ABILITIES

• Use logic and reasoning to identify the strengths and weaknesses of alternative solutions, conclusions or approaches to problems and make recommendations.
• Ability to prioritize multiple, competing assignments at one time and work independent !-- trimmed missing period? continues continuing line unchanged -->
• Ability to develop a highly effective team
• Strong influencing skills
• Exceptional written and oral communications skills
• Ability to build sustainable competitive advantages through pragmatic, innovative security solutions.
• Ability to anticipate, influence, and assist the organization to assess and rapidly adjust to changing conditions and trends (internal and external) of importance to the direction of the organization.

PHEAA’s environment welcomes and supports our employees, customers, and stakeholders; we seek out and value differing perspectives and contributions.