Information Security Officer

JobAps; Middletown (CT); Hybrid; USD 90,000 - 120,000; Full time

Benefits offered by this job

Professional growth opportunities

Healthy work/life balance

Benefits overview page

Job summary

JobAps is seeking an Information Security Officer (IT Analyst 3) to lead statewide security initiatives for DMHAS in a hybrid (telework/on-site) environment in Middletown, CT. The role focuses on aligning DMHAS tooling and practices with enterprise security standards, maturing endpoint protection, SIEM/SOAR, and vulnerability management.

The candidate will build internal DMHAS security capabilities, ensure HIPAA/42 CFR Part 2 compliance, and coordinate incident response with the Statewide

Qualifications

• Extensive knowledge of information systems security and risk management.
• Experience in policy, governance and regulatory compliance.
• Familiarity with HIPAA/42 CFR Part 2 confidentiality requirements.

Responsibilities

• Lead the maturation and scaling of statewide security platforms within DMHAS.
• Serve as DMHAS system security officer and principal advisor on security matters.
• Coordinate with Statewide Cybersecurity on enterprise incidents and audits.
• Develop security training and awareness programs for DMHAS staff.

Skills

Cybersecurity

IT Security

Incident Response

Risk Assessment

Compliance

Education

Bachelor's degree in IT or Cybersecurity

Tools

SIEM/SOAR

Vulnerability Management

Job description

Introduction

The State of Connecticut, Department of Administrative Services (DAS), Bureau of Information Technology Solutions (BITS) Statewide Cybersecurity Operations team is seeking to hire an Information Security Officer (Information Technology Analyst 3) with enterprise-wide responsibility and a focus on the Department of Mental Health and Addiction Services (DMHAS).

POSITION HIGHLIGHTS

Schedule: Full-Time (40 Hours), First Shift (8:00 A.M. - 4:30 P.M.), Monday - Friday, Hybrid (Telework/On-site)

Location: Middletown, CT

WHAT WE CAN OFFER YOU

• Professional growth and development opportunities
• A healthy work/life balance to all employees
• Visit our new State Employee Benefits Overview page!

THE ROLE

This position leads the maturation and scaling of statewide security platforms, tools, practices, and expertise into DMHAS. It acts as DMHAS's system security officer of record (principal advisor on technical and administrative matters involving the security of DMHAS's information systems) while embedded within DMHAS IT and working in close, ongoing coordination with the Statewide Cybersecurity team.

DISCOVER THE OPPORTUNITY TO

• Serve as DMHAS's embedded partner to the Statewide Cybersecurity team, ensuring DMHAS tooling, architecture, and practices align to enterprise security standards.
• Lead adoption, configuration, and maturation of statewide-deployed security platforms (endpoint detection and response, SIEM/SOAR, vulnerability management, and others) within DMHAS.
• Assess DMHAS's security program against statewide maturity benchmarks and execute roadmaps to close identified gaps.
• Build internal DMHAS security capability, including documentation, repeatable practices, staff expertise reducing reliance on ad-hoc knowledge.
• Act as DMHAS's system security officer of record and principal advisor on technical and administrative security matters.
• Maintain DMHAS compliance with the HIPAA Security Rule and 42 CFR Part 2 confidentiality requirements for substance use disorder treatment records.
• Work to align DHMAS policy & governance controls to statewide. Cybersecurity Policies, identify gaps or opportunities, maintain compliance consistent with NIST standards, HHS guidance, and statewide policy.
• Lead DHMAS incident tracking, response and reporting, coordinating with the Statewide Cybersecurity team on enterprise-level incidents.
• Prepare and represent DMHAS in audits, regulatory inquiries, and statewide security reviews.
• Design and deliver security and privacy training and awareness programs for DMHAS staff, including PHI/HIPAA-specific new-employees.
• Other duties as identified by Statewide Cybersecurity team.
• Although exceptionally rare, on-call may be required, such as extended hours and some weekends.

START WITH US. STAY WITH US. GROW WITH US.

PURPOSE OF JOB CLASS (NATURE OF WORK)

In a state agency Information Technology (IT) environment this class is accountable for performing the most complex and technical support work and/or acting as a working supervisor of Information Technology Analysts engaged in information systems development or technical support.

EXAMPLES OF DUTIES

• Diagnoses host system problems and develops and coordinates resolutions;
• Manages planning, analysis, design, selection, installation and implementation of new technologies;
• Evaluates new technologies;
• Tests and evaluates new hardware and/or software;
• Makes recommendations for hardware and/or software purchases;
• Determines interface and utility requirements and creates design specifications;
• Acts as liaison to hardware and/or software vendors, system developers, programmers and management;
• Develops and implements network and system security guidelines;
• Makes recommendations for migration and upgrade directions;
• Trains operators, systems developers and users on new procedures;
• Conducts system performance analysis, tuning or storage management;
• Conducts technical training programs for IT staff;
• Acts as project coordinator overseeing other technical staff and support personnel;
• Plans, coordinates and directs multiple projects of assigned staff;
• Reviews work of assigned personnel;
• Calculates project time and cost estimates;
• Prepares necessary procedural specifications to meet design requirements;
• Arranges necessary hardware and software availability;
• Oversees hardware and software vendors;
• Manages project budgets and schedules;
• Reviews work of assigned Information Technology Analysts and serves as consultant or troubleshooter;
• Reviews documentation work of assigned staff;
• Communicates with business owners and management;
• Facilitates meetings;
• Assists in the development of information technology policies, procedures and standards;
• Participates in Request for Proposal (RFP) process;
• Implements disaster recovery plans, assists in determining critical applications and personnel, or ensures offsite backups;
• Defines data flow;
• Performs related duties as required;

Systems Programming

• Performs the most complex duties related to application development;
• Develops and implements system programming standards;
• Configures and installs host-based application packages;
• Maintains host operating systems;
• Installs and upgrades host and/or Front End Processor (FEP) operating system software;
• Performs related duties as required;

Network Support

• Designs and implements complex communications networks;
• Diagnoses and resolves problems using network management systems and utilities;
• Performs related duties as required;

IT Security

• Develops, tests and maintains agency disaster recovery plans designed to restore IT system operability;
• Develops processes and procedures in support of IT Business Continuity Planning;
• Conducts platform recoverability assessments and Business Impact Analysis (BIA) to determine and assess the impacts associated with disruptions to business functions;
• Conducts risk analysis of IT environments by assessing administrative, technical and physical safeguards;
• Performs IT investigations to include maintaining chain of custody procedures;
• Performs forensics and documents detailed reports of findings;
• Performs related duties as required;

KNOWLEDGE, SKILL AND ABILITY

Considerable knowledge of principles and techniques of systems analysis, design, development, and computer programming; principles of information systems; principles and theories of business and planning functions; programming languages; project management principles and techniques; principles, problems and techniques of data processing and data communication operations; data processing and data communications equipment and diagnostic tools; methods and procedures used to conduct detailed analysis and design of computer systems; principles of complex computer operating systems;

Knowledge of principles and techniques of business information systems re-engineering; network protocols and architecture; practices and issues of systems security and disaster recovery; applications systems development principles and techniques; principles and practices of database management;

Considerable interpersonal skills; or... (text continues) ...

MINIMUM QUALIFICATIONS - GENERAL EXPERIENCE

Seven (7) years of experience in information technology (IT) operations, programming, systems/software development or another IT-related field.

MINIMUM QUALIFICATIONS - SPECIAL EXPERIENCE

One (1) year of the General Experience must have been at the full professional working level with responsibility for performing a full range of complex technical support functions in such areas as: assisting in the design, implementation and management of a major communications network; providing technical and administrative support for a wide area network (WAN) or mini-computer system; assisting in the installation and maintenance of major sub-systems or installing and maintaining other host and/or network software; participating in the design and development of system applications; serving as a project coordinator responsible for coordinating the design, development, programming and implementation of moderately complex information systems projects; performing any closely related complex technical support function.

NOTE: For state employees this experience is interpreted at the level of an Information Technology Analyst 2.

MINIMUM QUALIFICATIONS - SUBSTITUTIONS ALLOWED

College training in management information systems, computer science or information technology related area may be substituted for the General Experience on the basis of fifteen (15) semester hours equalling one-half (1/2) year of experience to a maximum of four (4) years for a Bachelor's degree.

A Master's degree in management information systems, computer science or electrical engineering may be substituted for one (1) additional year of the General Experience.

PREFERRED QUALIFICATIONS

• Bachelor’s degree in information technology, Computer Science, or Cybersecurity.
• Technical security certification, including Open Web Application Security Project, Azure Security Engineer, or Global Information Assurance Certification.
• Experience working in a Health Insurance Portability and Accountability Act (HIPPA) environment.
• Experience developing, improving, and coordinating information security program elements across cross-functional teams.
• Experience leading full lifecycle incident response and breach coordination for regulated compliance driven environments.

Conclusion

AN AFFIRMATIVE ACTION/EQUAL OPPORTUNITY EMPLOYER

The State of Connecticut is an equal opportunity/affirmative action employer and strongly encourages the applications of women, minorities, and persons with disabilities.

ACKNOWLEDGEMENT

As defined by Sec. 5-196 of the Connecticut General Statutes, a job class is a position or group of positions that share general characteristics and are categorized under a single title for administrative purposes. As such, a job class is not meant to be all-inclusive of every task and/or responsibility.