| Description |
TITLE: Information Technology (IT) Security & Compliance Analyst
SUMMARY
Under the direction of the Information Services Director, the Information Technology (IT) Security & Compliance Analyst will oversee, coordinate, enforce Information Security & Disaster Recovery efforts, protocols for the Crane School District. The job requirements will be accomplished by meeting following expectations: installing, configuring, monitoring security systems and alerts; and participates in the analysis, evaluation of enterprise information security, as well as ensures the district’s compliance with the Arizona Auditor General and other various compliance regulations. Takes on security-oriented responsibilities by implementing formal methodologies, educating, promoting, enforcing approved security policies, procedures, guidelines, standards and provides technical leadership of security and governance following the Crane Schools Leadership Mission.
ESSENTIAL FUNCTIONS __ Essential functions, as defined under the Americans with Disabilities Act, may include any of the following representative duties, knowledge, and skills. This list is ILLUSTRATIVE ONLY, and is not a comprehensive listing of all functions and duties performed by incumbents of this class. Employees are required to be in attendance and prepared to begin work at their assigned work location on the specified days and hours. Factors such as regular attendance at the job are not routinely listed in job descriptions, but are an essential function. Essential duties and responsibilities may include, but are not limited to, the following:
- Protects information technology's assets (i.e., hardware, software, data, etc.) by establishing and enforcing system access controls.
- Monitor and audit to ensure authorized access by investigating improper access; based on severity of issues immediately revoking access; reporting violations; recommending improvements.
- Monitor and analyze IT systems for unusual behavior or breaches; Respond to security incidents and audits and report status to management.
- Ensure network security devices and measures exist and function correctly. Performs periodic information security audits and risk assessments.
- Performs security monitoring, testing, prevention, and remediation activities across the network taking a proactive approach to mitigate district risks.
- Manage, develop, and coordinate security awareness program with updates, provide all management, end-user security training, and on-going communication.
- Provide reports, audit and monitors internet usage compliance and reports violations of The Crane Elementary School District #13 policy.
- Work with Information Services personnel and vendors to analyze, audit, mitigate any risks and compile regular network and security reports to present to the Director of Information Services and Executive Leadership.
- Ensure compliance with various IT Compliance Standards - NIST, HIPPA, PCI-DSS, COPPA, FERPA etc.
- Creates compliance policies & procedures, cyber incident response plan & procedure documentation, and education for Cyber Security Standards.
- Maintains accurate and current compliance documentation mandated by the Arizona Auditor General regulatory standard(s) as directed by the Director of Information Services, the Director of Finance, and Executive Leadership.
- Develops, implement, evaluates, documents, evaluates, and modifies Information Technology (IT) Compliance controls (i.e., DLP, MDM, Encryption, etc.) for all Information Technology Resources.
- Works with Information Services Staff, Human Resources Staff, Finance Staff to ensure IT Security Compliance deliverables are met.
- Coordinates, schedules, and documents IT Disaster Recovery Exercises with Information Services, schools, and operations support departments.
- Works with Information Services, schools, and operations support departments on keeping their business continuity plans and work arounds up to date.
- Works with Information Services on creating, evaluating, and maintaining their IT Disaster Recovery Plan and recovery procedures up to date.
- Works with Information Services on creating, evaluating, and maintaining server data backups.
- Evaluates new technology, and assists in the selection of new technologies that affect district-wide technology security and compliance; assists with Request for Proposals (RFP) development, proposal evaluations, vendor negotiations and contract management.
- Assist in the short and long-term planning and implementation of information technology security technologies and applicable expansion solutions by providing the most efficient and cost-effective technology.
- Supports the relationship between the school district and the general public by demonstrating courteous and cooperative behavior when interacting with citizens, visitors, and district staff; promotes the district goals and priorities and complies with all district policies and procedures.
- Maintains absolute confidentiality of work-related issues and district information.
- Follows industry/company standards regarding safety policies and procedures.
- Maintains work areas, tools, and PPE in a clean, orderly, and safe manner.
- Professional-upbeat attitude, assist and work harmoniously with vendors and Crane Schools employees.
- Uses information technology management tools to manage work orders and task requests.
- Performs other duties as required or assigned by Information Services Director.
- Troubleshoot, communicate, and resolve IT security problems in a timely manner.
- Assist and perform routine scheduled and emergency nonscheduled software, firmware, and hardware updates and upgrades.
- Support Information Services on-call staff afterhours with IT security incident management during the week, weekend, and holidays.
MINIMUM QUALIFICATIONS
- Education, Training and Experience Guidelines:
Bachelor's degree in Computer Science or equivalent IT security certifications (i.e., CISSP, CISA), and 1 of 2 entry level certifications (Security+, MTA Security Fundamentals); AND three + years' experience in an IT technical role; OR an equivalent combination of education, training and experience. 10 years’ experience in an IT security or a related technical role may be substituted for no Bachelor's degree in Computer Science or equivalent IT security certifications (i.e., CISSP, CISA),
Knowledge of:
- IT best practices for IT policies, procedures, standards, and guidelines.
- IT Security and IT Compliance Standards to include Arizona Criminal Justice Information Systems, Health Insurance Portability and Accountability (HIPPA), Payment Card Industry (PCI-DSS), Internal Revenue Services - Safe Guards (IRS 1074), Personally Identifiable Information (PII), Federal Information Processing Standards (FIPS), and the Nation Institution of Standards and Technology (NIST).
- Software enterprise applications, various operating systems used within a large IT environment, including ERP System, Public Safety Systems, Asset / Fleet Management Systems, Legal – CMS, video, and proximity systems, etc.
- Information security standards, logging (SIEM, etc.), and methodologies with excellent knowledge of change management processes, patch management, security methods, security tools and current mobile technologies.
- Enterprise data backups and best practices.
- Business continuity planning and best practices.
- IT disaster recovery planning and best practices.
- Cyber incident planning and best practices.
SKILLS:
- System hardening (i.e., firewall, security systems web, application, workstations, mobile devices, etc.), vulnerability assessments, security audits, intrusion detection / prevention and incident response.
- Researching problems that are difficult to identify or where facts may be insufficient and misleading.
- Handling sensitive or confidential information.
- Assessing customer support needs, and implementing effective solutions mitigating risks.
- Leadership, teamwork, presentation, and people management skills.
- Using initiative and independent judgment within established procedural guidelines with a focus on mitigating risks and protecting system data.
- Working in a group or independent in a technical environment with interlinked and changing priorities.
- Establishing and maintaining positive and cooperative working relationships with coworkers.
- Communicating effectively verbally and in writing.
- Ability to comprehend and execute complex written and oral instructions.
- Ability to communicate technical information to non-technical individuals.
PHYSICAL DEMANDS AND WORKING ENVIRONMENT
- Work is performed in a standard office environment; is required to lift objects up to 50 pounds, bend, stoop, crawl, and navigate tight spaces; requires use of hands; requires vision capacity at close range and ability to differentiate between colors.
- Good driving record.
REPORTS TO:
Information Technology Director
TERMS OF EMPLOYMENT:
Twelve-month work year. Salary and benefits as established by the Board.
EVALUATION:
Performance of this job will be evaluated in accordance with the Governing Board policy on evaluation.
Range 26
|