Knowledge Bank Information Security & Privacy Officer

Job Description and Duties

This position is limited term for 12 months but may be extended for an additional 12 months, not to exceed 2 years. This position may become Permanent/FT pending budget approval.

Under administrative direction of the Governor’s Office and Land Use and Climate Innovation (LCI) Information Technology Manager II, (Chief of Knowledge Bank and Platform Services), the Information Technology Specialist III (ITS III), Knowledge Bank Information Security and Privacy Officer serves as the lead privacy, data protection, security governance, and compliance analyst supporting the statewide Knowledge Bank initiative and related enterprise technology platforms.

The incumbent is responsible for leading enterprise privacy, data protection, and security governance activities to help ensure Knowledge Bank services, CEQA modernization systems, permitting coordination capabilities, cloud environments, public-facing systems, operational workflows, vendor solutions, and supporting infrastructure comply with State of California privacy laws, security requirements, audit standards, accessibility mandates, records management obligations, and enterprise governance frameworks.

The position supports statewide modernization initiatives by integrating privacy-by-design, security-by-design, accessibility, records management, operational governance, auditability, and compliance requirements into Knowledge Bank operations, application development efforts, procurement activities, enterprise workflows, service design, release planning, vendor oversight, and long-term technology planning while coordinating closely with the department’s Information Security Office and enterprise security leadership.  This position will also serve as a liaison between LCI program areas, agency partnerships, and third-party providers.  

You will find additional information about the job in the .

Working Conditions

Persons appointed to this position must be reasonably expected to lift, carry, push, pull, or otherwise move objects weighing up to 30 lbs. with or without a reasonable accommodation. This position involves sitting most of the time and may involve walking or standing for brief periods of time. This position may be eligible to participate in LCI’s hybrid telework schedule. Participation in telework is subject to LCI’s guidelines. Occasional extended hours outside of normal working business hours may be required.

Special Requirements

• Ability to maintain consistent attendance 

• Ability to demonstrate punctuality, initiative, and dependability

• Ability to work independently, while working with others in a small group environment

Desirable Qualifications

In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:

• Experience with risk management processes (e.g., methods for assessing and mitigating risk).
• Experience with frameworks, laws, regulations, policies, and ethics related to cybersecurity and privacy.
• Applicable business processes and operations of customer organizations.
• Business continuity and disaster recovery continuity of operations plans.
• Vulnerability information dissemination sources (e.g., alerts, advisories, errata, and bulletins).
• Information security program management and project management principles and techniques.
• Prior CISO/ISO and Privacy Officer experience.
• Currently certified in one or more of the following: CISM, CRISC, CDPSE.
• Experience with the State Administrative Manual (SAM) resource and compliance requirements.
• Experience with Office of Information Security (OIS), State Information Management Manual (SIMM) compliance requirements.
• Information Security Assessments and Information Security Program Audit processes.
• Managed or led all security program control initiatives across administrative, physical, and technical domains.
• Governance, Risk, and Compliance audit preparedness.
• Ability to integrate information security requirements into the acquisition process, using applicable baseline security.

controls as one of the sources for security requirements, ensuring a robust software quality control process.

• Ability to identify critical infrastructure systems with information and communication technology that were designed without system security considerations.
• Experience writing technical documentation for workflows, plans, guidelines, policies, standards and procedures to meet business requirements for security assurance and compliance.   

Benefits

There are many benefits to joining our team!We offer competitive pay, advancement opportunities, upward mobility, work-life-balance, and for many positions, flexible hours and remote work options. The State of California offers a competitive and comprehensive benefits package, subject to eligibility, such as:

• Medical Benefits, including  health , and  vision insurance
• Deferred Compensation options: 401k and 457b
• (Vacation/Sick or Annual Leave)
• Paid Holidays
• (College Saving Account)
• School Loan forgiveness under the federal  Public Service Loan Forgiveness Program

Statement of Qualifications (SOQ)

STATEMENT OF QUALIFICATIONS (SOQ)
IT SPECIALIST III

A Statement of Qualifications is required and must be submitted with your application. Applications received without a Statement of Qualifications may not be considered. 

The Statement of Qualifications must be typed, no more than two pages, using Arial 12-point font, and must include the applicant’s name in the header. Do not submit a cover letter in place of the Statement of Qualifications. 

Please respond to the following question: 

Describe your experience serving in an information security, privacy, risk management, compliance, audit, or security governance role supporting an enterprise technology project, modernization effort, public-facing digital service, cloud or SaaS platform, or regulated business environment. In your response, include your experience with privacy and data protection, security governance, risk assessments, compliance reviews, vendor or procurement reviews, architecture or system design reviews, audit readiness, incident response coordination, payment or financial transaction security, and working with legal, technical, vendor, business, and executive stakeholders.

Required Application Package Documents

The following items are required to be submitted with your application. Applicants who do not submit the required items timely may not be considered for this job:

• Current version of the State Examination/Employment Application STD Form 678 (when not applying electronically), or the Electronic State Employment Application through your Applicant Account at All Experience and Education relating to the Minimum Qualifications listed on the Classification Specification should be included to demonstrate how you meet the Minimum Qualifications for the position.
• Resume is required and must be included.
• Statement of Qualifications -

  A  Statement of Qualifications (SOQ)is  REQUIRED  and  MUST  be submitted with your application to be considered for this position. Applications received without the SOQ will not be considered. Résumés in lieu of the SOQ will not be considered. 

  Refer to the SOQ Requirement Section of this job posting for the SOQ questions.