Information Technology (IT) provides technical services, manages the county's technical resources, and provides consulting services for technology improvements through three programs: Administration, Operations, and Technology Solutions. These programs provide a complete range of technology services, which include strategic planning, new service design, business analysis, project management, security risk management, data security, applications delivery and support networks, servers and storage, desktop and mobile management, database administration, and end-user support through the service desk.
GENERAL STATEMENT OF DUTIES
Plan, organize, manage, and administer information security, operations, and functions; develop and implement program and strategic planning; implement and assist in the development of information security program policies, procedures, and business practices; evaluate goals, objectives, priorities, and activities to improve performance and outcomes; recommend and establish administrative controls and improvements; develop procedures to implement new and changing regulatory requirements; serve as an advisor to the management team.
SUPERVISION RECEIVED
Under general supervision of the IT Director, who assigns work, establishes goals, and reviews the results obtained for overall effectiveness through analyzing work products, observations, and meetings.
SUPERVISION EXERCISED
Full supervision, including employee selection and training, performance evaluation, complaint response, and personnel recommendations.
DISTINGUISHING CHARACTERISTICS
Develop and maintain the framework for the organization's IT information security. Evaluate and recommend new information security technologies and countermeasures against threats to information or privacy. Identify information technology security initiatives and standards for the enterprise. Manage the development, implementation, and maintenance of information security policy, standards, guidelines, and procedures. Set the access and authorization controls for everyday operations and emergency procedures for data. Set the standards for access controls, audit trails, event reporting, encryption, and integrity controls. Keep abreast of the latest security and legislation, regulations, advisories, alerts, and vulnerabilities about IT assets.
Typical Duties - Duties include, but are not limited to the following
Implement and manage security tools
Monitor and maintain security tools/systems (not limited to)
Endpoint Threat Protection Monitoring (Devices with Antivirus)
Cloud Security Monitoring, alerts & reports
Advanced Threat Protection (ATP)
SIEM or other logging and correlation technologies
Vulnerability Scans for security and compliance
Vulnerability remediation assessment and planning
Implement new security configurations
Research security configuration enhancements and make recommendations to management
Security Risk and Prevention
Monitor data access: ensure the internal control systems are monitored and that appropriate access levels are maintained following the principle of least privilege.
Conduct security assessments through vulnerability testing and risk analysis using available vulnerability scanning tools.
Assist with internal and external security audits.
Ensure adopted security policies, procedures, and best practices are followed.
Contribute to weekly security status reports to IT leadership.
Security Incident and Authoritative Contact
Analyze security breaches to identify the root cause.
Respond to potential security policy violations or complaints from external parties.
Assist in oversight and activities for intrusion detection and response.
Investigate security incidents and develop after-action reports.
Serve as a point of contact for external security auditors, survey requests, and for department security/privacy matters.
Assists in facilitating and promoting activities to create information security awareness and training.
Other duties as assigned by your supervisor.
Requirements for the Position
EXPERIENCE AND TRAINING
Bachelor's degree in computer science, information technology, or related field; AND
Five years of progressive experience in computing, information security, and internet technology, including two years of supervisory experience; OR
Any satisfactory combination of work, education, training, or experience relevant to the position, as determined by Marion County.
SPECIAL REQUIREMENTS
The finalist for this position will be required to pass a criminal history background check; however, conviction of a crime may not necessarily disqualify an individual for this position.
Must possess a current driver's license in the applicant's state of residence and an acceptable driving history. Marion County will obtain a copy of the driving record for all qualified applicants from Driver and Motor Vehicle Services and review the driving record according to the Marion County policy and procedure for Driving on County Business. The policy can be found at: http://apps.co.marion.or.us/APAP/.
This is a full-time exempt position, which is not eligible for overtime.
This assignment is not represented by a union.
Typical Work Schedule: Monday through Friday, 8:00 a.m. - 5:00 p.m., with flexibility depending upon the needs of the department and program.
PREFERENCES
Certified Information Systems Security Professional (CISSP), or formal security certifications from International Information System Security Certification Consortium (ISC)², Global Information Assurance Certification (GIAC), Computing Technology Industry Association (CompTIA), Information Systems Audit and Control Association (ISACA).
Information security principles and practices, including any of the following: security risk assessment standards, risk assessment methodologies, and vulnerability assessments.
Senior level knowledge of mainstream operating systems and a wide range of security technologies, such as network security appliances, identity and access management (IAM) systems, anti-malware solutions, automated policy compliance tools, and desktop security software.
KNOWLEDGE, SKILLS, AND ABILITIES
Knowledge of technology hardware and software which includes, but is not limited to systems, application languages, server based systems, cloud computing, personal computers, local and wide area network configurations and management, information and data management software and state-of-the-art system development and maintenance technologies; local, state, and federal laws, rules, policies, and regulations affecting information security and related technology and systems; strategic planning, preparation, and projection; and effective leadership and organizational communication principles and practices. Working knowledge of prevailing industry security standards and common body of knowledge gained by way of CISSP, SANS, or CISA Certifications.
Skills and abilities to manage and oversee comprehensive information security; lead diverse technologies, employees, and customer groups; communicate effectively in writing and orally, including the ability to make public or staff presentations; establish and maintain effective working relationships with a variety of individuals and groups, including customers in high-stress situations; and assist in confidential investigations. Skill in identifying information security problem areas, formulating diagnoses, and proposing practical solutions. Deep understanding of network infrastructure, including routers, switches, firewalls, and the associated network protocols and concepts. Ability to establish and maintain effective working relationships with employees, systems users, outside consultants, and vendors.
PUBLIC SERVICE LOAN FORGIVENESS
Marion County is a qualifying public employer for the Public Service Loan Forgiveness Program. Through the Public Service Loan Forgiveness Program, full-time employees working at the County may qualify for forgiveness of the remaining balance on Direct Loans after 120 qualifying monthly payments under a qualifying repayment plan. Questions about your loan eligibility should be directed to your loan servicer or the US Department of Education.
VETERANS’ PREFERENCE
Applicants are eligible to use Veterans’ Preference when applying with Marion County in accordance with ORS 408.225, 408.230, and 408.235 and OAR 105-040-0010 and 105-040-0015. Preference will be awarded only if the applicant meets the minimum requirements of the position and attaches the required documentation at the time of application.
DOCUMENTS REQUIRED FOR VETERANS’ PREFERENCE
One of the following:
MEMBER COPY 4 of the Certificate of Release or Discharge from Active Duty (DD Form 214 or 215); OR
Letter from the US Department of Veterans Affairs indicating receipt of a non-service connected pension; OR
Certification that discharge or release from active duty under honorable conditions will take place not later than 120 days after the submission of the certificate.
In addition to one of the above documents, Disabled Veterans must also submit one of the following:
A copy of their Veterans disability preference letter from the Department of Veterans Affairs; OR
Certification that medical separation from active duty under honorable conditions will take place not later than 120 days after the submission of the certificate.
You can request copies of your military service record through the National Archives website at http://www.archives.gov/veterans/military-service-records/
Marion County is an Equal Opportunity, Affirmative Action, Veteran and Disability employer committed to increasing the diversity of its workforce.
