Risk Management & Compliance Manager I

About Information Technology in the Administration Division Under the general supervision of the IT Director, serves as the Risk Management & Compliance Manager for the Information Technology section. Conducts risk management activities to identify current and future threats and to help the organization reach an acceptable level of risk. Provides the necessary subject-matter expertise and ensures implementation of the information security architecture, risk management standards, gap analysis, best practices, and systems/processes to ensure information privacy/protection. Will interact with management to determine acceptable levels of risk as the business model and risk profile change and align the security program accordingly. Review the security features of new information security practices, systems, and business services to ensure they meet the security requirements of new and existing policies. Review, on a timely basis, the various analyses of reports and logs obtained from firewalls, external and internal scanning devices, and security software. Reviews for noted irregularities, reports violations, and recommends solutions. Work with IT staff and outside vendors to determine the effectiveness and security of agency resources. Assist in the development of scenarios of usage, test for abnormalities or exposures. Use available tools to determine the effectiveness of Security and Risk programs and if guidelines and policies are being followed. Completes the Position Description process for all assigned employees. Assist in all areas of Information Technology as requested by the IT Director or Director of Administration. This position also includes an excellent benefits package: Public Service Loan Forgiveness eligibility. Paid parental leave. Health, dental, vision, long-term disability, and life insurance for employees, spouses, and children. Fifteen days of annual (vacation) leave per year. Fifteen days of sick leave per year. Thirteen paid holidays each year. State Retirement Plan and Deferred Compensation Programs. Bachelor's degree in computer science, business, or related discipline. FIve years of experience in Information Technology, of which at least three years were in the information security field.

Additional Requirements:

Position may require employees to work evenings and weekends. Position may be required to report to work during emergency situations. Experience using Microsoft Defender or a similar XDR Solution. Knowledge of applicable internal and/or external regulatory policies, standards, procedures, and controls. Knowledge of governance, risk and compliance (GRC) program management. Understanding of risk assessment process, monitoring, and reporting. Ability to apply information security principles to business solutions. Ability to act as liaison and effectively communicate information security topics (e.g., data constraints, information needs) to both technical and non-technical audiences at all levels of the organization. Knowledge of developing and managing an information security program, including its policies, standards, procedures, technologies, and controls. Knowledge in identifying and managing information security risks, threats, and incidents at an enterprise level.

DRUG SCREENING, CREDIT CHECK, DELINQUENT TAX CHECK, SLED BACKGROUND CHECK, AND GRIEVANCE CHECK ARE REQUIRED. THIS OFFICE IS AN EQUAL OPPORTUNITY AND AFFIRMATIVE ACTION EMPLOYER. EEOP

Utilization Report available upon request We are committed to providing equal employment opportunities. If you have a limitation or disability that requires an accommodation during the application process, please let us know by emailing recruitment@scag.gov