Job Summary
Plan, organize, and coordinate the implementation, operation, and maintenance of the College's information security operations, practices, and controls to support the achievement of institutional objectives. Coordinate and oversee the security of College information systems, including applications, databases, identity systems, messaging platforms, endpoint devices, cloud services, and network infrastructure. Provide reporting services and recommendations regarding the overall security posture of technology resources. Work collaboratively with members of the Enterprise Information Security team, Office of Information Technology staff, institutional stakeholders, and external organizations regarding all aspects of SLCC information security.

Essential Duties & Responsibilities & Knowledge Skills & Abilities
The individual must be able to perform each essential duty satisfactorily. These requirements represent the knowledge, skills, and abilities required for the position. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the position.

Professional Skills

Ability to read, analyze, and interpret technical journals, reports, regulations, standards, and industry guidance.
Ability to respond effectively to inquiries and complaints from customers, governance bodies, auditors, and external organizations.
Ability to present technical and security-related information to both technical and non-technical audiences.
Ability to identify, analyze, and solve complex technical and operational problems through collection and interpretation of relevant information.
Ability to manage multiple projects and priorities in a collaborative environment.
Ability to document findings, recommendations, and technical procedures in a clear and professional manner.
Ability to communicate effectively with a broad range of people with a variety of abilities and backgrounds, to maintain good working relationships across the College.
Ability to work with all groups from a variety of academic, socioeconomic, cultural, and ethnic backgrounds, and with community college students, faculty, and staff, including those with disabilities.
Information Security and Technical Skills
Working knowledge of information security principles, practices, and frameworks.
Working knowledge of identity and access management technologies, including multi-factor authentication, conditional access, privileged access management, and account lifecycle processes.
Working knowledge of security monitoring, threat detection, and incident response processes.
Working knowledge of vulnerability management programs and vulnerability assessment tools.
Working knowledge of endpoint security technologies and Endpoint Detection and Response (EDR/XDR) platforms.
Working knowledge of data classification, sensitivity labeling, data governance, and Data Loss Prevention (DLP) technologies.
Working knowledge of Microsoft security and compliance technologies, including Microsoft Purview and related information protection capabilities.
Working knowledge of email security, messaging protection, inbound and outbound message defense, phishing protection, and related threat management processes.
Working knowledge of user and service account management, file systems, and associated security controls.
Working knowledge of enterprise patch management processes and technologies.
Working knowledge of network security technologies, including enterprise firewalls, intrusion detection and prevention systems (IDS/IPS), network segmentation, and threat monitoring platforms.
Working knowledge of Palo Alto Networks firewall administration, security policy management, threat prevention technologies, and network traffic analysis.
Working knowledge of network systems analysis and design.
Working knowledge of multi-vendor WAN/LAN, wired and wireless network infrastructure components.
Working knowledge of Microsoft Windows client and server operating systems.
Working knowledge of Linux/Unix server operating systems and related administration tools.
Working knowledge of data risk management, disaster recovery planning, business continuity planning, configuration management, and backup processes.
Working knowledge of cloud security principles, identity security, data protection, and security monitoring for cloud-hosted services.
Working knowledge of security awareness, phishing awareness, and cybersecurity education programs.
Working knowledge of audit support activities, security assessments, control reviews, evidence collection, and remediation tracking.
Working knowledge of regulatory and compliance requirements, including FERPA, HIPAA, PCI-DSS, and applicable information security standards.
Working knowledge of cybersecurity frameworks and standards, including NIST Cybersecurity Framework, NIST Special Publications, CIS Critical Security Controls, and ISO 27001.
Working knowledge of penetration testing methodologies and security assessment techniques.
Additional Responsibilities
Participate in investigations involving information security incidents, technology misuse, records requests, and other activities involving institutional data and technology resources.
Coordinate with internal departments, auditors, legal counsel, and law enforcement when required.
Participate in interviewing, hiring, training, and mentoring employees as assigned.
Provide information and guidance regarding compliance with institutional policies, security standards, and acceptable use requirements.
Assist with security awareness, education, and outreach activities designed to support institutional cybersecurity practices.
Support internal and external audits, assessments, and compliance activities by collecting evidence, documenting controls, coordinating stakeholders, and tracking remediation efforts.
Assist with security reviews of cloud-hosted services and Software-as-a-Service platforms to help identify appropriate security controls.
Minimum qualifications
Bachelor's Degree in Computer Science, Information Security, Information Systems, or a related field required.
Six (6) to nine (9) years of professional experience in information technology, including responsibilities related to information security, cybersecurity operations, network administration, server administration, risk management, compliance, or related disciplines.
Equivalent combinations of education and experience may be considered.