Information and Security Officer

Title: Information and Security OfficerState Role Title: Salary Non-SpecifiedHiring Range: Hiring range for this position is $116,077.60 - $133,489.24, commensurate with education and experiencePay Band: UGAgency: VA Cannabis Control AuthorityLocation: VA Cannabis Control AuthorityAgency Website: Type: General Public - GJob DutiesProgram LeadershipLeads the Virginia Cannabis Control Authority cybersecurity program in support of program and administrative information systems and technology.Policy, Compliance and AuditDevelops and maintains cybersecurity policies and standards for Authority information technology infrastructure and data.Implements and maintains one or more risk management frameworks in order to protect all information technology infrastructure and assets from external and internal threats.Ensures CCA cybersecurity compliance and serves as a key point of contact with Authority affiliated audit and compliance personnel.Maintains and reviews commercial and governmental IT policies, standards and guidelines, ensuring the Authority follows established best practices.Security Awareness and TrainingOversees the information security training program for Authority employees and manages ongoing security awareness and role-based security training.Risk Management, Security Operations, Projects, and Incident ResponseManages IT security operations, overseeing cybersecurity monitoring, detection, and management platforms. Identifies risks and vulnerabilities, engaging with stakeholders in security responses.Participates in the Authority Change Management process and evaluates changes for security risks.Assists in the development of a comprehensive continuity of operations and disaster recovery plans.Manages crisis situations, which may involve complex information security issues and leads events through completion including overseeing and reporting all forensic activity. Develop and maintain very positive and professional customer service and/or relations within the Authority and with all constituencies to include citizens, patients, practitioners, licensees, and contractors. Demonstrates a positive and professional attitude and treats everyone with dignity and respect.Safety issues are reviewed and communicated to ensure a safe and healthy workplace and a reduction in work-related absence.Other duties as assignedFollow workplace safety regulations and adhere to applicable standards, processes, and programs established for your position.Report unsafe work conditions to your supervisor.Immediately report work-related incidents to your supervisor and participate in accident investigation requests.Minimum QualificationsPossesses working knowledge of all areas within the IT department including information security, systems, network infrastructure, identity management, application development, and endpoint security.Significant knowledge and awareness of security trends, legislation, and policy.Comprehensive knowledge of current information security threats, weaknesses and vulnerabilities and good working knowledge of zero-day exploits.Ability produce and manage IT security corrective action plans.Demonstrated ability to model professional integrity and behavior.Excellent organization and planning skills.Superior communication skills, including the ability to write complex technical documentation for varied audiences Required Education and ExperienceMaster’s Degree or a Bachelor’s Degree, or equivalent combination of education and professional experience.Experience building and maintaining information security programs.In-depth experience participating in incident response planning and security breach investigations.Demonstrated experience delivering security awareness and training programs.Experience evaluating, administering and executing enterprise security programsAdditional ConsiderationsPreferred (Optional) Education and ExperienceExperience leading, supervising, and facilitating state government technical security teams.Familiarity with continuity of operations, business impact analysis, disaster recovery, and risk management frameworks.Experience serving as incident commander during information security incidents.Special InstructionsYou will be provided a confirmation of receipt when your application and/or résumé is submitted successfully. Please refer to “Your Application” in your account to check the status of your application for this position.Contact InformationName: VCCA Recruitment TeamPhone: 804-653-9735Email: View email address on click.appcast.io support of the Commonwealth’s commitment to inclusion, we are encouraging individuals with disabilities to apply through the Commonwealth Alternative Hiring Process. To be considered for this opportunity, applicants will need to provide their AHP Letter (formerly COD) provided by the Department for Aging & Rehabilitative Services (DARS), or the Department for the Blind & Vision Impaired (DBVI). Service-Connected Veterans are encouraged to answer Veteran status questions and submit their disability documentation, if applicable, to DARS/DBVI to get their AHP Letter. Requesting an AHP Letter can be found at AHP Letter or by calling DARS at View phone number on click.appcast.io.Note: Applicants who received a Certificate of Disability from DARS or DBVI dated between April 1, 2022- February 29, 2024, can still use that COD as applicable documentation for the Alternative Hiring Process.Reasonable accommodations are available to individuals with disabilities during the application and/or interview processes per the Americans with Disabilities Act. Please call View phone number on click.appcast.io for assistance. The Commonwealth of Virginia is an Equal Opportunity Employer. It is the policy of the Commonwealth of Virginia to prohibit discrimination on the basis of race, sex, color, national origin, religion, sexual orientation, gender identity or expression, age, veteran status, political affiliation, disability, genetic information, pregnancy, childbirth or related medical conditions in the recruitment, selection, and hiring of its workforce.