IT Security Architect

Description

• Security Architecture and Technical Risk Leadership – Evaluates systems, networks, applications, cloud services, identity platforms, and technology solutions to identify security risks, establish appropriate technical standards and controls, and promote secure and resilient technology environments.
• Incident Readiness and Response Leadership – Leads cybersecurity incident preparedness and response activities, including planning, coordination, escalation, evidence preservation, recovery, post-incident review, and continuous improvement.
• Cross-Agency Collaboration and Advisory Support – Builds productive working relationships with participating agencies, technology teams, leadership, LASOs, county partners, vendors, and other stakeholders and provides practical cybersecurity guidance that supports coordinated risk reduction while respecting agency governance and operational authority.
• Cybersecurity Awareness and Continuous Improvement – Monitors evolving threats, regulatory requirements, security frameworks, and industry practices and translates those developments into appropriate policies, controls, training, exercises, and improvements to CMSNet cybersecurity capabilities.

• Security Architecture and Technical Risk Leadership – Evaluates systems, networks, applications, cloud services, identity platforms, and technology solutions to identify security risks, establish appropriate technical standards and controls, and promote secure and resilient technology environments.
• Incident Readiness and Response Leadership – Leads cybersecurity incident preparedness and response activities, including planning, coordination, escalation, evidence preservation, recovery, post-incident review, and continuous improvement.
• Cross-Agency Collaboration and Advisory Support – Builds productive working relationships with participating agencies, technology teams, leadership, LASOs, county partners, vendors, and other stakeholders and provides practical cybersecurity guidance that supports coordinated risk reduction while respecting agency governance and operational authority.
• Cybersecurity Awareness and Continuous Improvement – Monitors evolving threats, regulatory requirements, security frameworks, and industry practices and translates those developments into appropriate policies, controls, training, exercises, and improvements to CMSNet cybersecurity capabilities.

Essential Duties

•   Establish cybersecurity maturity objectives, performance measures, assessment methods, and reporting structures to evaluate and communicate the effectiveness of the cybersecurity program. Maintain a CMSNet-wide cybersecurity risk register and lead periodic, structured risk assessments across participating agencies.
• Assist agencies in interpreting and applying security obligations established through CJIS, Local Rules, Supreme Court Rules of Superintendence, and other applicable judicial, county, or regulatory requirements.
•    Participate in CMSNet Steering Committee activities and provide cybersecurity expertise regarding policies, governance matters, risk considerations, and multi-agency security initiatives.       
• Monitor emerging cybersecurity risks, regulatory developments, and industry practices and recommend appropriate changes to policies, procedures, and security controls.

•  Lead cybersecurity incident response activities throughout the incident lifecycle, including preparation, detection, analysis, containment, eradication, recovery, and post-incident review.
• Maintain and regularly update the CMSNet Incident Response Plan, including defined responsibilities, communication protocols, escalation procedures, severity criteria, and notification requirements.
• Maintain incident response documentation and resources, including service-level expectations, response runbooks, contact information, notification trees, system references, and architecture documentation necessary to support an effective response.
• Coordinate multi-agency incident response activities with Network Support, Application Support, County Technical Services, LASOs, agency leadership, vendors, and other appropriate partners. Establish and maintain procedures for preserving cybersecurity evidence, including log retention, system imaging, documentation, and chain-of-custody requirements.
•  Lead post-incident reviews involving appropriate agencies and stakeholders and incorporate lessons learned into security controls, detection capabilities, policies, procedures, and remediation efforts.
•  Coordinate required notifications and reporting to county oversight entities and other appropriate parties in accordance with applicable regulatory or organizational timelines.
•  Evaluate incident response capabilities and identify opportunities to improve organizational preparedness, communication, coordination, and response effectiveness.

• Oversee CMSNet enterprise vulnerability management processes, including authenticated and unauthenticated internal and external vulnerability scanning.
• Review identified vulnerabilities, assess risk and remediation priorities, and coordinate corrective actions with Technical Services, agency information technology teams, system owners, and contracted vendors.
•  Track vulnerability remediation efforts and communicate significant risks, unresolved vulnerabilities, and remediation progress to appropriate leadership and stakeholders.
• Oversee security governance related to service accounts, multifactor authentication, password requirements, privileged access, and other identity and access management practices.
•  Support efforts to strengthen and centralize identity management platforms, directory services, authentication practices, and access governance across CMSNet.
• Develop and maintain secure configuration standards for systems, networks, applications, and related technology environments.
• Evaluate security practices and technical controls to identify opportunities to reduce risk, strengthen resilience, and improve consistency across CMSNet agencies.

• Serve as a primary cybersecurity advisor and resource for participating CMSNet agencies and agency leadership.
• Build and maintain productive working relationships with agency information technology teams, County Technical Services, LASOs, leadership, and other stakeholders to promote coordinated cybersecurity practices.
• Assist agencies with adopting or adapting CMSNet cybersecurity policies, standards, and practices while respecting individual agency governance and operational authority.
• Coordinate annual cybersecurity awareness and training programs across CMSNet agencies.
• Develop and facilitate multi-agency cybersecurity tabletop exercises using realistic, high-impact scenarios to evaluate organizational preparedness and response capabilities.
•  Conduct follow-up assessments after exercises and incorporate identified improvements into incident response plans, policies, procedures, training, and operational practices.
• Promote a security culture that encourages timely reporting of suspected incidents, vulnerabilities, and cybersecurity concerns without discouraging employees from raising potential issues.
• Communicate cybersecurity risks, expectations, and technical concepts in a manner that is understandable and actionable for technical and nontechnical stakeholders.

• Manage and monitor cybersecurity requirements applicable to vendors and third-party service providers, including CJIS background requirements, required security training, data protection obligations, and other contractual security requirements.
• Coordinate periodic vendor security reviews, risk assessments, compliance verification, and documentation requirements.
•  Evaluate cybersecurity considerations associated with proposed technology acquisitions, hosted services, cloud environments, third-party integrations, and other external technology solutions.
• Monitor cybersecurity risks associated with vendors, technology providers, software supply chains, and third-party systems and coordinate appropriate mitigation or remediation activities.
•  Partner with Purchasing, the Prosecutor’s Office, agency leadership, and other appropriate stakeholders to develop and review contract provisions addressing cybersecurity, data protection, privacy, incident notification, regulatory compliance, and related requirements.
• Monitor vendor compliance with established cybersecurity requirements and elevate material risks or deficiencies for appropriate review and action.

Preferred Skills

• Recognized cybersecurity frameworks and standards, including CIS Controls, the NIST Cybersecurity Framework, CJIS Security Policy, and other applicable governmental or regulatory security requirements.
• Cybersecurity governance, risk management, and compliance practices, including risk identification, assessment, treatment, documentation, monitoring, and reporting.
• Security architecture principles, including defense-in-depth, segmentation, secure system design, least privilege, zero trust concepts, and methods for reducing technical and operational risk.
• Network and infrastructure security concepts, including firewalls, routing, remote access, endpoint protection, monitoring, logging, intrusion detection, and secure communications.
• Identity and access management principles, including authentication, authorization, multifactor authentication, privileged access management, service accounts, directory services, and access lifecycle management.
• Vulnerability management practices, including vulnerability identification, scanning methodologies, risk-based prioritization, remediation, validation, and exception management.
• Cybersecurity incident response principles and practices, including preparation, detection, analysis, containment, eradication, recovery, evidence preservation, chain of custody, and post-incident review.
• Security monitoring, logging, threat detection, and the use of security information to identify suspicious activity, investigate incidents, and support risk-based decision-making.
• Cloud, hosted-service, and third-party security concepts, including shared responsibility, data protection, access controls, vendor risk, system integrations, and software supply-chain considerations.
• Secure configuration and system-hardening practices for servers, workstations, network devices, applications, cloud environments, and related technology infrastructure.
• Data protection principles, including confidentiality, integrity, availability, encryption, retention, access control, and appropriate handling of sensitive or regulated information.
• Vendor and third-party cybersecurity risk management, including security assessments, contractual security requirements, compliance verification, incident notification obligations, and ongoing monitoring.
• Cybersecurity awareness, training, tabletop exercises, and organizational preparedness practices used to strengthen security culture and incident readiness.
• Emerging cybersecurity threats, vulnerabilities, attack methods, technologies, regulatory developments, and industry practices that may affect CMSNet and participating agencies.

• Provide strategic and technical cybersecurity guidance across multiple agencies while maintaining alignment with CMSNet security objectives, operational priorities, and applicable requirements.
• Exercise independent judgment and discretion when evaluating cybersecurity risks, incidents, vulnerabilities, technical controls, and competing operational priorities.
• Assess complex technology environments and identify security risks, control gaps, architectural concerns, and opportunities to strengthen organizational resilience.
• Develop and maintain practical cybersecurity policies, standards, procedures, and governance practices that support consistent security expectations across CMSNet.
•  Lead and coordinate cybersecurity incident response activities involving multiple agencies, technical teams, leadership, vendors, and other stakeholders.
• Evaluate cybersecurity risk and prioritize remediation efforts based on potential impact, likelihood, operational needs, available resources, and applicable security requirements.
• Interpret cybersecurity frameworks, regulatory requirements, and organizational obligations and translate them into practical security controls, procedures, and recommendations.
• Build and maintain strong, professional working relationships with agency leadership, information technology teams, County Technical Services, LASOs, vendors, and other internal and external stakeholders.
• Communicate cybersecurity risks, technical concepts, incidents, and recommendations clearly and concisely to both technical and nontechnical audiences.
• Facilitate collaboration across agencies and stakeholders to address cybersecurity risks while recognizing individual agency governance authority and operational requirements.
• Manage multiple cybersecurity initiatives, assessments, remediation efforts, and priorities simultaneously while maintaining appropriate documentation and follow-through.
• Approach cybersecurity challenges with a practical, risk-based, solutions-oriented mindset and a commitment to continuous improvement.

• Cybersecurity architecture, risk assessment, security governance, and development of enterprise security standards and controls.
• Cybersecurity incident response, including preparation, analysis, containment, eradication, recovery, evidence preservation, documentation, and post-incident review.
• Vulnerability management, including vulnerability assessment, risk prioritization, remediation tracking, and coordination with technical teams and system owners.
• Identity and access management practices, including privileged access, multifactor authentication, service accounts, password controls, directory services, and access governance.
• Applying recognized cybersecurity frameworks and requirements, including CIS Controls, the NIST Cybersecurity Framework, CJIS Security Policy, and other applicable governmental or regulatory security requirements.
• Evaluating the security of networks, systems, applications, cloud environments, hosted services, third-party integrations, and other technology solutions.
• Developing secure configuration standards, cybersecurity policies, procedures, incident response plans, technical documentation, and related security resources.
• Assessing vendor and third-party cybersecurity risk, security requirements, compliance obligations, and technology-related contract considerations.
• Developing cybersecurity metrics, risk reporting, assessment methods, and documentation used to communicate cybersecurity posture and significant risks to leadership and stakeholders.
• Planning and facilitating cybersecurity awareness activities, training programs, tabletop exercises, and other preparedness initiatives.

Qualifications

• Bachelor’s Degree in Cybersecurity, Information Technology, Computer Science, Information Systems, Engineering, or a related field required.
• Five (5) years of progressively responsible professional cybersecurity experience in an enterprise, government, or similarly complex technology environment required.
• Experience working in government, public-sector, criminal justice, court, law-enforcement, or other regulated technology environments preferred.
•  Professional cybersecurity certification such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Cloud Security Professional (CCSP), GIAC certification, or comparable industry-recognized certification preferred.
•  Any equivalent combination of education, certification, experience, and training which provides the required knowledge, skills, and abilities.

• This job operates in a professional office environment. This role routinely uses standard office equipment such as computers, phones, photocopiers, and filing cabinets.  The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job.  This is a sedentary job, and the employee will sit 75% of their workday.   The employee is expected to use a computer keyboard for extended periods of time and lift and/or move up to 10 pounds and occasionally lift and/or move up to 25 pounds.