| Summary Description: Under direction of the Director of the Department of Cybersecurity and Technology Infrastructure, coordinates, designs, and maintains system-wide information security and compliance initiatives; safeguards enterprise systems and data by defining access privileges, control structures, and resources, as determined by best practices, industry standards, and stakeholder needs; identifies and mitigates system vulnerabilities, violations, and inefficiencies through routine audits; provides status updates on system performance through multiple means; acts on privacy breaches and malware threats. Executes and supports Risk Management Framework (RMF) activities and ensures compliance with Maryland Department of IT processes and documentation standards. Supports enterprise architecture governance by maintaining architecture artifacts, system documentation, and technical configuration diagrams. Lead engineer on network Disaster Recovery solutions, reviewing vendor security reports, and cybersecurity strategies. Effectively communicates with staff and stakeholders, including senior leadership.
Physical Demands: Position is required to work at computer workstations for sustained periods of time.
Special Requirements: Ability to work extended hours, especially during peak periods and when urgent work requirements exist.
|
|
Thorough knowledge and experience with risk management processes, cybersecurity and privacy policies and procedures, vulnerability and threat management, vulnerability assessment tools and techniques, network security principles and practices. Ability to identify and mitigate network vulnerabilities, as well as communicate best practices to avoid security flaws. Thorough knowledge of disaster recovery and business continuity best practices for critical systems required. Ability to construct high level and detail level network security and disaster recovery diagrams to be shared with management, other departments, and coworkers. Ability to manage multiple complex projects and tasks while paying close attention to details. Thorough knowledge of risk management framework and system risk assessments to prepare school system for state and county audits by documenting the environment and providing guidance to system stakeholders. Strong analytical and problem-solving skills. Skilled in decision making with a track record of exercising good judgment. Must be detail-oriented, highly organized, and an effective communicator. Excellent oral and written communication and human relations skills. |
|
Education Training Experience: Bachelor of Science or Bachelor of Arts degree in Computer Science, Information Technology systems, or related field from an accredited university required. Master’s degree preferred. Five years or more documented professional experience in technology. Proven experience in information system security operation, information system security assessment, system documentation, risk mitigation, vulnerability management, networking systems and/or network security (i.e., DNS, firewalls, proxies), agentless security, and XaaS (e.g., SaaS, IaaS, PaaS, DaaS, FaaS). Experience implementing industry standard information security frameworks, policies and procedures. Experience supporting GRC capabilities such as policy management, security awareness training, third-party risk management, and metrics and reporting. Experience in deploying various solutions to scale GRC processes including but not limited to security questionnaires, risk assessment, evidence collection, and control testing. Experience designing, reviewing, deploying, and auditing AI-powered solutions (including agents) and apply LLMs/NLP to analyze policies, audit findings, and regulatory requirements preferred. Certificate License: Professional certification in one or more of the following: CISSP, CompTIA Security+, CISA preferred. |
|
Example Duties:Note: (Incumbents may perform any combination of the essential functions shown below. This position description is not intended to be an exhaustive list of all duties, knowledge, or ability associated with this classification, but is intended to accurately reflect the core job elements.)Researches and recommends security measures to protect system assets based on information technology trends and security standards. Ensures systems comply with Maryland minimum enterprise architecture, governance frameworks, and cybersecurity standards established by the Maryland Department of IT. Ensures cybersecurity maturity assessments are conducted every two (2) years with the goal of improving results. Ensures appropriate collection of artifacts and evidence of compliance with the Maryland minimum standards and for Maryland maturity assessments. Ensures that cybersecurity vulnerabilities are detected in a timely manner. Ensures that cybersecurity vulnerabilities are remediated by either repair or documented risk mitigation in a timely manner. Ensures appropriate documentation of technology risk management in accordance with the Maryland cybersecurity standards. Implements and monitors technology compliance solutions to ensure the environment is configured to follow industry best practices. Works closely with the district’s firewall and web filter vendor to provide the most comprehensive enterprise solutions possible. Leverages technology tools to monitor network and systems security (SIEM, log analyzers, antivirus); performs routine penetration testing and preventative maintenance in collaboration with network administrators; deploys security measures to protect systems and infrastructure, including firewalls, IPS/IDS, and web content filtering. Documents security breaches and assesses the impact to district assets. Mitigates potential vulnerabilities to ensure data integrity. Maintains current knowledge of available patches, deciding what patches are appropriate for particular systems, ensuring that patches are installed properly, testing systems after installation, and documenting all associated procedures, such as specific configurations required. May need to perform security video record extraction audits to validate that logs are properly updated. Stays current on IT security trends and news. Interfaces with other MCPS departments to ensure proper security protections; reviews and suggests revisions to the MCPS security and acceptable use policies and regulations. Reviews and revises disaster recovery and business continuity plans. Builds partnerships with collaborators while keeping management up-to-date with the status of major deliverables, as well as sustains strong working relationships with stakeholders and peers to enhance business value. Participates actively in change advisory and governance boards, assessing the impact of proposed changes and communicating required security artifacts. Understands and applies the seven core competencies of the Supporting Services Professional Growth System (SSPGS) commitment to students, knowledge of job, professionalism, interpersonal, communication, organization, and problem solving. Performs related duties consistent with the scope and intent of the position. |
