Director, Information Security

Department of Building; New York (NY); Hybrid; USD 180,000 - 240,000; Full time

Job summary

The NYC Department of Buildings seeks a Director, Information Security to lead enterprise architecture, cloud platforms, and cybersecurity operations. You will drive a secure, scalable, and compliant technology platform across DOB’s mission-critical systems and collaborate with internal teams and external partners to reduce risk.

This hands-on leadership role requires strong business acumen, experience in risk management, and a track record of building security programs that align with

Qualifications

• Master's degree in computer science or equivalent with relevant IT management experience.
• Minimum 3 years in progressively responsible IT leadership roles with security focus.
• Experience implementing enterprise security controls and RMF/audits.

Responsibilities

• Oversee strategic and long-term information and cybersecurity roadmap.
• Strengthen corporate security program across vulnerability, incident, and threat management.
• Manage IT infrastructure projects including networks, servers, and security infrastructure.
• Lead risk profiling, escalation, and resolution with cross-functional teams.
• Develop and manage information security budgets and governance.

Skills

IT leadership

Cybersecurity

Risk management

Stakeholder management

Education

Master's degree in computer science

Bachelor's degree in related field

High school diploma + 6 years experience

Tools

SOAR technologies

Azure cloud

Security monitoring tools

Job description

At the NYC Department of Buildings, we are responsible for ensuring the safe and lawful use of buildings and properties by enforcing the NYC Construction Codes, Energy Code and Zoning Resolution. We facilitate compliant development with integrity, efficiency, and professionalism. As an Agency, we are committed to remaining a premier municipal building organization, dedicated to enhancing the quality of life for all New Yorkers and making our city safer. As an employer, we are committed to improving our performance and developing procedures that are streamlined, understandable, and transparent. We are seeking a dynamic leader to serve as the Director, Information Security.

Director, Information Security will provide strategic and operational leadership for enterprise architecture, cloud platforms, and cybersecurity operations. Reporting to the Executive Director, Information Security, this role ensuring reliability, scalability, and security of mission-critical systems supporting DOB’s mission to serve New York City. Director, Information Security will work with all areas of DOB’s businesses to further enhance and architect a shared vision for “best in class" information security, enterprise architecture and compliance program that will assess appropriate technology platform risks and protect value in DOB’s core business.

Director, Information Security is a hands‑on technical leadership role responsible for maintaining a robust security posture and reliable infrastructure operations across DOB’s technology platform. This role owns the security and operations of DOB’s entire enterprise architecture including, network routers and switches, server infrastructure, cloud solutions, on prem and public facing firewalls, endpoint vulnerability including modernization initiatives.

The Director, Information Security is responsible for strengthening and executing information security posture, strategy, policy, enforcement, risk mitigation and cybersecurity awareness. Responsibilities will also encompass security and Risk Management Framework (RMF) focused architecture and engineering of the enterprise, while defining security standards, developing and implementing security controls.

The successful candidate must possess skills to actively engage with internal agency technology teams and maintain strong working relationships with external technology partners such as OTI and NYC Cyber Command while streaming technology stack as well as a strong ability to effectively manage direct reports, resource allocation and prioritization, budgets, and key performance indicators. This position requires a seasoned leader with strong business acumen and detailed working knowledge of information security technologies, practices, policies, and their application to a business and act calmly and competently in high‑pressure, high‑stress situations.

Duties and Responsibilities

• Oversee and implement a sustainable, strategic and long‑term information and cybersecurity roadmap that deliver world‑class cyber protection for the agency.
• Strengthen DOB’s corporate security program in the areas of Vulnerability Management, Incident Management, Threat Management, and Security Awareness.
• Enhance existing Threat Management and Incident Management functions, including analysis, triage and escalation of security events, coordination and tracking of response activities.
• Manage IT infrastructure implementation and operations, including networks, servers, desktops, telecommunications, voice, security infrastructure
• Provide leadership and vision for the strategic development and management of computing information systems, network communications, telecommunications, voice services, applications, information security systems, and technology infrastructure that will support DOB staff and facilities.
• Manage an IT Incident Response Team, security incidents and events to protect agency assets, including intellectual property, regulated data.
• Manage all phases of Vulnerability Management including scanning, reporting, and remediation tracking.
• Oversee vulnerability remediation activities, coordinate with other stakeholders to plan and track remediation activities.
• Maintain standard operating procedures (SOP) and documentation of IT processes as needed to support business operations, architecture, security, disaster recovery, standards, and purchasing while establishing and enforcing IT policies, processes, portfolio management, standards, and methodologies.
• Authorize and oversee the deployment, monitoring, maintenance, development, and support of all hardware and software based on department data centers, telecommunications, and user end‑point needs.
• Identify potential and emerging information security threats, vulnerabilities, and control techniques.
• Support agency leadership to review enterprise IT and cyber risks, assess capabilities, prioritize security and risk strategies and communicate risk intelligence in a way that drives business decision‑making.
• Engage and coordinate cross‑functional stakeholder participation in risk profiling, investigation, escalation and resolution.
• Provide leadership to individual contributors, build risk capabilities and build program oversight.
• Assess risk tolerance, implement and oversee appropriate security processes and foster a security‑aware culture for the agency.
• Develop and manage information security and infrastructure budgets and monitor them for variances.
• Continuously identify and spearhead opportunities to improve the efficiency and effectiveness of the Information Security operations and processes.
• Coordination of maintenance and patching of Information Security Systems.
• Oversee security awareness activities including security awareness training and proactive phishing exercises.
• Participate in projects to evaluate, develop and implement technologies to support security operations.
• Maintain and publish metrics.
• Monitor/Review external threat environment, DAST and penetration scans and advise relevant stakeholders on the appropriate courses of action and liaise with external agencies, such as NYC Cyber Command, OTI and other advisory bodies as necessary, to ensure that the agency maintains a strong security posture.
• Provide subject matter expertise to executive management with a broad range of security standards and best practices.
• Assess applications through threat modeling, code review and security testing while providing guidance on effective countermeasures.
• Contribute to security architecture and assist in building and rolling out processes for secure code development and deployment.
• Propose solutions for secure application design, DevSecOps automation, tool optimization, application vulnerability management and strategies for risk reduction.
• Plan, review and approve change management processes for network and security modifications, including documenting changes, validating implementation steps, and supporting rollback planning.
• Enhance the protection of agency critical applications through collaboration with constituents, analysts, and application developers to address security risks throughout the Software Development Life Cycle (SDLC).
• Review roadmaps, designs, and specifications with applications teams to assist craft application security features and improvements.

CIVIL SERVICE STATUS

Only those who are permanent in the Computer Systems Manager civil service title, applicants who are reachable on the Computer Systems Manager open competitive list, and applicants as indicated below will be considered.

Candidates who are permanent in comparable civil service titles may be considered for title change under rule 6.1.9 of the Personnel Rules and Regulations of the City of New York.

REMOTE WORK

This position may be eligible for remote work up to 2 days per week, pursuant to the Remote Work Pilot Program.

Minimum Qualifications

1. A master's degree in computer science from an accredited college or university and three (3) years of progressively more responsible, full‑time, satisfactory experience in Information Technology (IT) including applications development, systems development, data communications and networking, database administration, data processing, or user services. At least eighteen (18) months of this experience must have been in an administrative, managerial or executive capacity in the areas of applications development, systems development, data communications and networking, database administration, data processing or in the supervision of staff performing these duties; or

2. A baccalaureate degree from an accredited college or university and four (4) years of progressively more responsible, full‑time, satisfactory experience as described in "1" above; or

3. A four‑year high school diploma or its educational equivalent, and six (6) years of progressively more responsible, full‑time, satisfactory experience as described in "1" above; or

4. A satisfactory combination of education and experience equivalent to "1", "2" or "3" above. However, all candidates must have at least a four‑year high school diploma or its educational equivalent and must possess at least three (3) years of experience as described in "1" above, including the eighteen (18) months of administrative, managerial, executive or supervisory experience as described in "1" above.

In the absence of a baccalaureate degree, undergraduate credits may be substituted for a maximum of two (2) years of the required experience in IT on the basis of 30 semester credits for six (6) months of the required experience. Graduate credits in computer science may be substituted for a maximum of one (1) year of the required experience in IT on the basis of 30 graduate semester credits in computer science for one (1) year of the required IT experience. However undergraduate and/or graduate credits may not be substituted for the eighteen (18) months of experience in an administrative, managerial, executive or supervisory capacity as described in "1" above.

Preferred Skills

• Minimum 8 years of IT leadership and management experience in a large and complex organization with multiple ongoing IT initiatives.
• Minimum 5 years of practical experience designing and implementing enterprise information technology security demonstrates industry‑leading security innovation skills and an eye towards understanding the threat environment from a preventative posture.
• Proven experience interfacing with senior executives and business leader level and communicating complex cybersecurity concepts to technical and non‑technical audiences.
• Experience with information disaster recovery planning and testing, auditing, risk analysis, business system resumption planning, and contingency planning.
• Experience in Security Incident Response and Vulnerability Management is required.
• Understanding of common vulnerabilities and exploits is required.
• Knowledge of the cyber threat landscape including types of adversaries and the motivations that drive them is required.
• Experience with threat hunting and cyber intelligence is desired.
• Experience with implementing or operating Security Orchestration, Automation and Response (SOAR) technologies is desired.
• Must be knowledgeable in IP Networking, enterprise architecture, firewalls and other security appliances, Web Application Firewalls, virtualization, blade technology, enterprise storage solutions, VOIP, wireless technologies, telecommunication, public facing computing solutions, end‑user solutions and technologies.
• Experience in architecture/design, implementation and administration of data, VOIP and wireless networks, firewalls, security infrastructure, virtualization, and desktop support.
• Advance technical skills, technical oversight and support for the design, availability, optimization, performance and capacity management of network services, troubleshooting of various enterprise network technologies.
• Define security controls and practices for desktop, cloud, and legacy applications.
• Familiarity with security best practices and risk management operating in cloud environments such as Azure, and in corporate use of other 3rd party SaaS products.
• Strong demonstration of application secure best practices, and the ability to articulate problem statements and propose solutions to both technical and non‑technical audiences.
• Demonstrate experience with IT security audits, IT security controls assessment, information security and cybersecurity, systems implementation, and systems architecture in addition to working knowledge of NIST Special Publication 800‑53 and Cybersecurity Framework.
• CISSP (Certified Information Systems Security Professional) certification.
• Baccalaureate degree in computer science, computer engineering, information security, or related field.
• Master’s degree in business or public administration, computer science, computer engineering, information security, or a related field.

55a Program

This position is also open to qualified persons with a disability who are eligible for the 55‑a Program. Please indicate at the top of your resume and cover letter that you would like to be considered for the position through the 55‑a Program.

Public Service Loan Forgiveness

As a prospective employee of the City of New York, you may be eligible for federal loan forgiveness programs and state repayment assistance programs. For more information, please visit the U.S. Department of Education’s website at https://studentaid.gov/pslf/.

Residency Requirement

New York City Residency is not required for this position

Additional Information

The City of New York is an inclusive equal opportunity employer committed to recruiting and retaining a diverse workforce and providing a work environment that is free from discrimination and harassment based upon any legally protected status or protected characteristic, including but not limited to an individual's sex, race, color, ethnicity, national origin, age, religion, disability, sexual orientation, veteran status, gender identity, or pregnancy.