Director, Information Security

About the role

Reporting to the Executive Director, Information Security, this hands-on technical leadership role is responsible for maintaining a robust security posture and reliable infrastructure operations across the Department of Buildings’ entire enterprise architecture. The Director, Information Security will provide strategic and operational leadership for enterprise architecture, cloud platforms, and cybersecurity operations, ensuring the reliability, scalability, and security of mission-critical systems that support DOB’s mission to serve New York City.

Responsibilities

• Oversee and implement a sustainable, strategic, long-term information and cybersecurity roadmap that delivers world-class cyber protection for the agency.
• Strengthen DOB’s corporate security program in Vulnerability Management, Incident Management, Threat Management, and Security Awareness.
• Enhance existing Threat Management and Incident Management functions, including analysis, triage and escalation of security events, and coordination and tracking of response activities.
• Manage IT infrastructure implementation and operations, including networks, servers, desktops, telecommunications, voice, and security infrastructure.
• Provide leadership and vision for the strategic development and management of computing information systems, network communications, telecommunications, voice services, applications, information security systems, and technology infrastructure that support DOB staff and facilities.
• Manage an IT Incident Response Team, security incidents and events to protect agency assets, including intellectual property and regulated data.
• Manage all phases of Vulnerability Management including scanning, reporting, and remediation tracking; oversee remediation activities and coordinate with stakeholders to plan and track remediation.
• Maintain standard operating procedures and documentation of IT processes to support business operations, architecture, security, disaster recovery, standards, and purchasing; establish and enforce IT policies, processes, portfolio management, standards, and methodologies.
• Authorize and oversee the deployment, monitoring, maintenance, development, and support of all hardware and software based on department data centers, telecommunications, and user end-point needs.
• Identify potential and emerging information security threats, vulnerabilities, and control techniques; support agency leadership to review enterprise IT and cyber risks, assess capabilities, prioritize security and risk strategies, and communicate risk intelligence to drive business decision-making.
• Engage and coordinate cross-functional stakeholder participation in risk profiling, investigation, escalation, and resolution.
• Provide leadership to individual contributors, build risk capabilities, and provide program oversight; assess risk tolerance and implement and oversee appropriate security processes.
• Foster a security-aware culture for the agency; develop and manage information security and infrastructure budgets and monitor for variances.
• Continuously identify and spearhead opportunities to improve the efficiency and effectiveness of Information Security operations and processes.
• Coordinate maintenance and patching of Information Security Systems; oversee security awareness activities including training and proactive phishing exercises.
• Participate in projects to evaluate, develop, and implement technologies to support security operations; maintain and publish metrics.
• Monitor and review the external threat environment, DAST and penetration scans, and advise stakeholders on appropriate courses of action; liaise with external agencies such as NYC Cyber Command and OTI to ensure a strong security posture.
• Provide subject-matter expertise to executive management on a broad range of security standards and best practices.
• Assess applications through threat modeling, code review, and security testing; provide guidance on effective countermeasures; contribute to security architecture and help build and roll out processes for secure code development and deployment.
• Propose solutions for secure application design, DevSecOps automation, tool optimization, application vulnerability management, and strategies for risk reduction.
• Plan, review, and approve change management processes for network and security modifications, including documenting changes, validating implementation steps, and supporting rollback planning.
• Enhance the protection of agency-critical applications through collaboration with constituents, analysts, and application developers to address security risks throughout the Software Development Life Cycle (SDLC).
• Review roadmaps, designs, and specifications with application teams to assist in crafting application security features and improvements.

Requirements

• Civil Service Status: Permanent in the Computer Systems Manager title, reachable on the Computer Systems Manager open competitive list, or comparable civil service title eligible for title change under rule 6.1.9 of the Personnel Rules and Regulations of the City of New York.

Minimum Qualifications

• A master’s degree in computer science from an accredited college or university and three years of progressively responsible, full-time experience in IT (applications development, systems development, data communications and networking, database administration, data processing, or user services), including at least eighteen months in an administrative, managerial, or executive capacity in one of these areas; or
• A baccalaureate degree and four years of progressively responsible IT experience, including at least eighteen months in an administrative, managerial, or executive capacity; or
• A four-year high school diploma and six years of progressively responsible IT experience, including at least eighteen months in an administrative, managerial, or executive capacity; or
• A satisfactory combination of education and experience equivalent to the above, provided that all candidates have at least a four-year high school diploma and at least three years of IT experience, including eighteen months of administrative, managerial, executive, or supervisory experience.

Preferred Skills

• Minimum 8 years of IT leadership and management experience in a large, complex organization with multiple ongoing IT initiatives.
• Minimum 5 years of practical experience designing and implementing enterprise information technology security, demonstrating industry-leading security innovation and a preventative threat posture.
• Proven experience interfacing with senior executives and business leaders and communicating complex cybersecurity concepts to both technical and non-technical audiences.
• Experience with information disaster recovery planning and testing, auditing, risk analysis, business system resumption planning, and contingency planning.
• Experience in Security Incident Response and Vulnerability Management is required.
• Understanding of common vulnerabilities and exploits is required.
• Knowledge of the cyber threat landscape including types of adversaries and their motivations is required.
• Experience with threat hunting and cyber intelligence is desired.
• Experience with implementing or operating Security Orchestration, Automation and Response (SOAR) technologies is desired.
• Knowledgeable in IP networking, enterprise architecture, firewalls and other security appliances, Web Application Firewalls, virtualization, blade technology, enterprise storage solutions, VOIP, wireless technologies, telecommunications, public-facing computing solutions, and end-user technologies.
• Experience in architecture/design, implementation, and administration of data, VOIP and wireless networks, firewalls, security infrastructure, virtualization, and desktop support.