Chief Information Security Officer

About the role

The NYC Department of Environmental Protection (DEP) enriches the environment and protects public health for all New Yorkers by providing 1.1 billion gallons of high-quality drinking water, managing wastewater and stormwater, and reducing air, noise, and hazardous materials pollution. DEP is the largest combined municipal and wastewater utility in the country, with nearly 6,000 employees. DEP's water supply system comprises 19 reservoirs and 3 controlled lakes throughout a 2,000 square mile watershed extending 125 miles north and west of the city. The New York City Department of Environmental Protection (NYC DEP) Business Information Technology (BIT) division provides quality business, technical, and information technology system support to agency users through collaboration, strong relationships, and a unified vision with DEP partners to deliver technology solutions that support the agency’s operational needs. Reporting to the Chief Information Officer (CIO), the BIT team seeks to hire a Chief Information Security Officer (CISO).

Responsibilities

• Develop and implement the organization’s information security strategy to protect data and systems from cyber threats.
• Research and recommend innovative solutions and improvements to existing procedures.
• Develop and manage strong strategic relationships within Information Technology (IT) and ensure that projects, initiatives, and security platforms meet all required security standards.
• Safeguard information system assets by identifying security risks, threats, and vulnerabilities affecting networks, systems, and applications across new and existing technology initiatives.
• Evaluate high-level information technology initiatives and provide technical guidance to ensure compliance with security policies, standards, and guidelines.
• Develop, implement, enforce, and communicate security policies and plans covering data, software applications, hardware, and telecommunications systems.
• Require in-depth knowledge of Internet Protocol (IP) networking and networking protocols, along with security technologies including encryption, Internet Protocol Security (IPsec), Public Key Infrastructure (PKI), Virtual Private Networks (VPNs), firewalls, proxy services, Domain Name System (DNS), electronic mail systems, privileged access management, and access lists.
• Have experience with Operational Technology (OT) networks and Supervisory Control and Data Acquisition (SCADA) environments.
• Serve as a recognized subject matter expert in internet, web, application, and network security engineering, including vulnerability assessments, network scanning, and threat surface analysis.
• Possess advanced knowledge of cloud service security models and enterprise data protection strategies, including backup architecture, disaster recovery planning, and business continuity frameworks.
• Oversee the system’s cybersecurity program and support the new NYS Cybersecurity requirements for water and wastewater.
• Lead the development, coordination, and submission of materials required to maintain compliance with the New York State Cybersecurity Regulations for Public Water Systems.
• Manage and direct a team of information technology security professionals, providing leadership, guidance, and support.
• Manage cybersecurity incidents and attacks in coordination with the team and oversight agencies such as New York City Cyber Command (NYC Cyber Command).
• Track cyber security incidents and vulnerability reports, direct teams for remediation of issues.
• Design a critical response process for cyber security incidents.
• Continuously monitor threats to DEP’s information technology (IT) and operational technology (OT) environments.
• Develop cybersecurity Key Risk Indicators (KRIs) and dashboard metrics for reporting.
• Develop and document cybersecurity policies, procedures, and standards in alignment with Citywide Information Security Policies.
• Coordinate air-gapped backup strategies with agency business units.
• Participate in annual financial and technology audits for the agency.
• Examine computer systems to ensure secure operation and protection of data from internal and external threats.
• Perform security assessments to ensure compliance with security policies, procedures, and industry standards.
• Monitor, evaluate, and maintain security systems according to industry best practices to safeguard internal systems and databases.
• Assist with the review and definition of security requirements and evaluate systems for compliance with established standards.
• Investigate security violations and breaches and prepare reports on incidents and intrusions as required.
• Review and assess firewall logs and configure firewalls, intrusion detection systems, and other network security devices.
• Work with other BIT teams to design and implement cybersecurity solutions across DEP infrastructure, networks, and systems.
• Develop necessary budget analysis and related documentation for annual submissions of budget for cyber‑security related solutions.

Requirements

• A bachelor’s degree from an accredited college.
• Four years of satisfactory experience qualifying for the duties and responsibilities of the position, at least 18