Security Operations Lead

The State of Connecticut Department of Administrative Services (DAS) Bureau of Information Technology Solutions (BITS) is currently accepting applications for an anticipatedSecurity Operations Lead (Information Technology Manager 2) to direct security operations for the Connecticut Executive Branch. BITS runs the states shared technology services and its enterprise security program protecting the systems and data of Executive Branch employees.

WHAT WE CAN OFFER YOU

• Our State Employee Benefits Overview page!
• Professional growth and development opportunities.
• A healthy work/life balance to all employees.

THE ROLE

The Security Operations Lead (IT Manager 2) reports to the state Chief Information Security Officer and leads the Security Operations function including the virtual Security Operations Center the security information and event management and security orchestration platforms Endpoint Detection and Response (EDR) security incident response digital forensics and others. The position supervises a team of security operations staff. Under the State Response Framework the role supports cyber incident planning response and recovery for state government under Emergency Support Function 17 (ESF-17). The Security Operations Lead can expect to:

• Direct the Security Operations Center and its associated technology platforms including security monitoring alert triage and escalation for executive branch agencies.
• Manage the operation of the enterprise security information and event management and security orchestration platforms including data onboarding platform availability log source coverage and day-to-day operation.
• Direct the states response to information security incidents serving as incident coordinator for confirmed incidents and coordinating with affected agencies the Connecticut Intelligence Center and internal and external partners.
• Direct digital forensic investigations including evidence handling and the delivery of findings to legal counsel human resources agency leadership and law enforcement.
• Supervise assign and evaluate the work of security operations staff and contracted consultants.
• Establish and report operational measures for the function including alert volume coverage of monitored log sources and time to detect and contain.
• Build and maintain incident response plans playbooks and response exercises coordinated with agency information security officers and when required with the Division of Emergency Management and Homeland Security.
• Lead the security teams collaboration with information technology teams to improve identity security including access reviews privileged access management and conditional access design.
• Manage vendor and service provider relationships supporting security operations.
• Plan the staffing training and budget for the function.
• Delegated authority:
• Directs response activity across executive branch agencies during a cyber security incident including coordination of response with staff outside this positions normal reporting line.
• Determines when an incident requires escalation to the Chief Information Security Officer for regulatory notification decisions.
• Approves containment actions that may interrupt state systems or service during an active incident.

FOR ASSISTANCE IN APPLYING:
Check out our Applicant Tips on How to Apply! Need more resources Visit our Applicant Toolkit for additional support throughout the recruitment process.

BEFORE YOU APPLY:

• Meet Minimum Qualifications: Ensure you meet the Minimum Qualifications listed on the job opening by the job closing date. You must specify your qualifications on your application. The minimum experience and training requirements listed must be met by the close date on the job opening unless otherwise specified.
• Educational Credits: List your earned credits and degrees from accredited institutions accurately on your application. To receive educational credits towards qualification the institution must be accredited. If the institution of higher learning is located outside of the U.S. you are responsible for providing documentation from a recognized USA accrediting service which specializes in determining foreign education equivalencies to the contact listed below by the closing date listed on the job posting.
• Resume Policy: Per Public Act 21-69 resumes are not accepted during the initial application process. As the recruitment process progresses candidates may be required to submit additional documentation to support their qualification(s) for this position. This documentation may include: a cover letter resume transcripts diplomas performance reviews attendance records supervisory references licensure etc. at the request and discretion of the hiring agency.
• Preferred Shift/Location: Select all location(s) and shift(s) you are willing to work on your application. Failure to do so may result in not being considered for vacancies in that specific location or shift.
• Timely Submission: All application materials must be received by the job posting deadline. You will be unable to make revisions once you officially submit your application to the State. Late submissions are rarely accepted with exceptions only for documented events that incapacitate individuals during the entire duration of the job posting. Request exceptions by emailing
• Salary Calculations: For current state employees salary calculations are not necessarily comparable from one of the three branches of state government (i.e. Executive Legislative Judicial) to the other.
• Note: The only way to apply to this posting is via the Apply or Apply Online buttons on the official State of Connecticut Online Employment Center job posting.

AFTER YOU APPLY:

• Some email providers may experience delays or issues delivering messages. To avoid missing important updates such as referral questionnaires or interview scheduling linksplease check your Personal Status Board regularly. For added convenience you can also enable text (SMS) notifications. To do this log in to your Personal Status Board and select Update My Contact Information.
• Referral Questions: This posting may require completion of additional Referral Questions (RQs) which must be completed by the questionnaires expiration date. If requested RQs can be accessed via an email sent to you after the job close date or by visiting your JobAps Personal Status Board (Certification Questionnaires section).
• Prepare For An Interview: Interviews are limited to those whose experience and training are most aligned with the role. To prepare review this helpful Interview Preparation Guide to make the best impression!
• Stay Connected! Log in daily to your JobAps Personal Status Board to track your status and check email (including spam/junk folders) for updates and tasks.
• The immediate vacancy is listed above however applications to this recruitment may be used for future vacancies in this job class.
• Note: This position will be filled in accordance with contractual language reemployment SEBAC transfer promotion and merit employment rules. Candidates who are offered and accept a position with the State of Connecticut are bound by the State Code of Ethics for Public Officials and State employees available at employer may participate in EVerify and will provide the federal government with your Form I9 information to confirm work authorization.

QUESTIONS WERE HERE TO HELP:
Due to high volume we are unable to confirm receipt or provide status updates directly. For recruitment updates please check your Personal Status Board and review our Frequently Asked Questions. If you have additional questions about the recruitment process reach out to Brittney Woodley at . Join the State of Connecticut and take your next career step with confidence!

• Plan and Deploy for Business Results which includes the ability to develop and implement business plans IT plans budget plans and human resource plans in order to maximize budget allocations technology personnel and other resources to achieve agency and program goals.
• Lead Change which includes innovation the ability to be a creative problem solver and a strategic thinker and the ability to recognize and develop opportunities to grow and develop information technology services in response to customers and a changing work environment.
• Focus on Results and Quality including exercising and promoting accountability and the ability to analyze surveys financial and other data and use strategic planning and performance measurement techniques to continuously improve performance and maintain competitiveness.
• Understand Customers and Markets which includes the ability to establish customer satisfaction and loyalty forecast and conduct market analyses keep ahead of industry trends and incorporate best practices into information technology operations.
• Lead People including the ability to resolve conflict communicate effectively coach and train employees recognize performance and foster diversity and teamwork.
• Build Coalitions including the ability to explain and advocate facts and ideas in a convincing manner to negotiate with individuals and groups internally and externally to gain cooperation from others and to identify the internal and external politics that impact the work of the organization.
• Business Knowledge including knowledge of the technical professional procedural and legal requirements of the specific information technology area.

Two (2) years of the General Experience must have been in a supervisory capacity or one (1) year of the General Experience must have been in a managerial capacity.

NOTE: For state employees this experience is interpreted as two (2) years at the level of an Information Technology Supervisor or one (1) year at the level of an Information Technology Manager 1 or Agency Information Technology Manager.

• College training in computer science management information systems or a closely related field may be substituted for the General Experience on the basis of fifteen (15) semester hours equalling one half (1/2) year of experience to a maximum of four (4) years for a Bachelors degree.
• A Masters degree in computer science management information systems or a closely related field may be substituted for one (1) additional year of the General Experience.

• Possession of a current certification issued by Global Information Assurance Certification (GIAC).
• Experience supervising a team of five (5) or more employees who perform security operations functions.
• Experience working in an operationally focused security role accountable for the operation of a security operations center.
• Experience serving as the incident coordinator for confirmed information security incidents.
• Experience working in a digital forensic investigation function.

• The Information Technology Project Manager is limited to the Department of Administrative Services Bureau of Information Technology Solutions and Centers of Information Technology Excellence as identified by the statewide Chief Information Officer. Managers functioning in this capacity oversee a portfolio of large long range or multiple on-going projects. The complexity of the assignment is determined by project scope risk exposure span of control diversity of skill-sets and capabilities as well as the size of project budget and number of team members. They oversee all phases of projects from conception to completion utilizing PMI standards.
• Incumbents assigned to positions designated to perform Information Technology Project Management may be required to possess Certification as a Project Management Professional (PMP).
• The Solutions Architect is limited to the Department of Administrative Services Bureau of Information Technology Solutions and Centers of Information Technology Excellence as identified by the statewide Chief Information Officer. Managers functioning in this capacity oversee all aspects of solution architect projects which includes the development of technology solutions and mapping business requirements to systems and technical requirements ensuring alignment with the enterprise architectural plan.