Manager Information Technology Services 2 Information Security - 11291

Duties Description The New York State Office of Information Technology Services (ITS) provides operational support 24 hours a day, 7 days a week, 365 days of the year, supporting more than 4,900 applications for 53 New York State Agencies.

Within the Office of Information Technology Services (ITS)/Chief Technology Office (CTO)/Shared Delivery Services/Data Center Networks (DCN), Network Security group, the Manager Information Technology Services 2 Information Security, SG-29, will serve as lead network security manager and subject matter expert overseeing the teams responsible for managing all network security aspects of New York State (NYS) ITS voice and data networks, both on premises and Cloud (52 agencies; 135,000 users).
Specific duties may include, but are not limited to, the following:
- Serve as lead network security manager and subject matter expert overseeing the teams responsible for managing all network security aspects of NYS ITS voice and data networks, both on premises and Cloud (52 agencies; 135,000 users):
- F5 Unit - Manages F5's Application Delivery and Security Platform to deliver high-performance network security in a full-proxy architecture, combining firewalling, DDoS protection, DNS security, and intrusion prevention with quantum-resilience. Core security functions include Full-Proxy Architecture, Web Application Firewall, DDoS Mitigation, SSL/TLS Orchestration, Zero Trust Enforcement, and Hybrid Multi-Cloud Scaling.
- Web Application Firewall Unit - Manages the specialized Layer 7 application-layer defense that filters, monitors, and blocks HTTP and HTTPS traffic between the Internet and a web application to protect backend servers from application-layer attacks.
- Content Filtering Unit - Manages content filtering within the data centers, NYExchange, and within ITS managed Clouds; implements and maintains Layer 7 firewall security policies/profiles to provide appropriate levels of Internet access to agency servers and end users in accordance with agency requests and cybersecurity posture.
- Microsegmentation Unit - Manages the advanced network security method that divides a data center or Cloud environment into distinct, secure zones down to the individual workload, application, or container level.
- Data Center Firewall (Voice/Data) Unit - Manages the full lifecycle of all physical, virtual, and Cloud-based security barriers (firewalls and IPS devices) to protect enterprise assets and ensure secure network connectivity for NYS agencies and their applications; this includes managing firewall security policies/profiles, and Virtual Private Network tunneling between Palo Alto Networks Cloud Next Generation Firewalls on premises (ZEN and Utica) and within the Cloud environments (Microsoft Azure, Amazon Web Services, and Google Cloud Platform). Responsibilities include design, implementation, deployment, operations (monitoring and alerting, patch management, backup and recovery), optimization, ITSM service/change/incident management, maintenance, and decommissioning.
- Serve as primary liaison with the ITS Chief Information Security Office to facilitate enterprise security reviews/audits, employ proactive security measures, and, as necessary, lead remediation efforts to address findings and ensure that network security practices are abiding by vendor's best practices, state/federal requirements, and are as secure as reasonably possible.
- Manage and ensure compliance with ITS, CTO, DCN, and manufacturer policies, procedures, technical and security standards.
- Design and implement on-premises to Cloud connectivity solutions as required by application needs in collaboration with the Chief Information Security Office and network/application/architecture teams.
- Manage the design, deployment, and maintenance of network virtual appliances as needed including Palo Alto PAN-OS with integrations into Cloud Service Provider network infrastructure.
- Manage ITSM Service Requests and Incidents in all aspects of network security in the NYS ITS voice and data networks.
- Facilitate knowledge transfer and technical training for network security staff for all on premises and Cloud technologies.
Provide expert in-depth analysis on network security performance using tools such as Zenoss, Splunk, Palo Alto Panorama, NfSen, Ixia, Gigastor, Wireshark, etc.
Manage and lead in the orchestration of multi-discipline technologies for the resolution of complex problems; communicate with technology and business leaders for problem resolution and make recommendations for system enhancements as required.
- Provide 24x7x365 on-call management network support for advanced troubleshooting, escalation, and ticket resolutions on a rotating basis.
- Troubleshoot carrier-class network equipment and end-to-end network connectivity; proficiency in Layer 3 routing required, including Border Gateway Protocol (BGP), Virtual Routing and Forwarding (VRF), route maps, redistribution, Network Address Translation (NAT), subnetting, etc.
- Manage staff responsible for ensuring network availability within the NYS ITS voice and data networks and Cloud environments is maximized by managing Change Control procedures, code upgrades, network monitoring, installations, and troubleshooting complex issues.
- Participate in network performance analysis, training, and capacity planning.
- Participate in DCN's annual planning for budget Spend Plan IDs (SPIDs) to meet operational needs related to projects, staffing, equipment, and procurement for network security; understanding of all required NYS purchasing and procurement guidelines.
- Occasional travel may be required.
- Perform the full range of supervisory responsibilities.

Minimum Qualifications Manager Information Technology Services 2 (Information Security)
Non-competitive: Eight years of information technology, cybersecurity, or information assurance experience*, including two years at the supervisory level.
*Substitutions:
A bachelor's or higher-level degree in any field including or supplemented by 15 semester credit hours in computer science or related field substitutes for three years of required experience; any bachelor's substitutes for two years of required experience.
An associate degree with 15 semester credit hours in computer science or related field may substitute for one year of required experience. Candidates in a bachelor's degree program with at least 15 semester credit hours in computer science or related field may substitute such credits for one year of required experience.
A master's degree or higher in computer science or related field substitutes for one year of required experience.

Preferred Qualifications:

Proven ability to work independently and as a team member
Proven ability to lead teams and develop network engineers
Proven analytical, problem solving, organizational, and time management skills
Good communication (written and oral) and interpersonal skills
Good organizational, multi-tasking, and time-management skills
Proficiency in Layer 3 routing including BGP, VRFs, route maps, redistribution, NAT, subnetting, etc.
Proficiency in Palo Alto PAN-OS including security policies, NAT policies, zones, routing, tunnels, upgrades, logging, and monitoring
Proficiency in IPSec and MACsec encrypted transport for Cloud connectivity across carrier networks and the Internet
Proficiency in Domain Name System (DNS) and managing split-brain public/private resolution designs
Experience working with monitoring and packet capture/analysis tools such as Zenoss, Splunk, Palo Alto Panorama, NfSen, Ixia, Gigastor, Wireshark, etc.
Networking certifications (CCNA/CCNP, PCNSA/PCNSE, Network+, etc.) are a plus

Additional Comments ITS will not offer permanent employment to any candidate unless the candidate provides documentation that they are authorized to accept work in the United States on a permanent basis. It is the policy of ITS not to hire F1 or H1 visa holders for permanent employment or to sponsor non-immigrant aliens for temporary work authorization visas or for permanent residence.

Some positions may require fingerprinting.

Some positions may require up to 25% travel and/or lifting up to 50 lbs. Some positions are pending Civil Service approval. Details of position(s) will be described further if you are selected for an interview.

If eligible, positions located in New York City will receive an additional $3,400 downstate adjustment location pay with regular annual salary. Positions located in the Mid-Hudson will receive an additional $1,650 adjustment location pay.
to permanent non-competitive and the official probationary period will begin.

Benefits of Working for NYS Generous benefits package, worth 65% of salary, including:
Holiday & Paid Time Off
Thirteen (13) paid holidays annually
Up to Thirteen (13) days of paid vacation leave annually
Up to Five (5) days of paid personal leave annually
Up to Thirteen (13) days of paid sick leave annually for PEF.
Up to three (3) days of professional leave annually to participate in professional development

Health Care Benefits
Eligible employees and dependents can pick from a variety of affordable health insurance programs
Family dental and vision benefits at no additional cost

Additional Benefits
New York State Employees' Retirement System (ERS) Membership
NYS Deferred Compensation
Access to NY 529 and NY ABLE College Savings Programs, as well as U.S. Savings Bonds
Public Service Loan Forgiveness (PSLF)
And many more.

The Office of Information Technology Services is an equal opportunity employer, and we recognize that diversity in our workforce is critical to fulfilling our mission. We encourage all individuals with disabilities to apply.

Some positions may require additional credentials or a background check to verify your identity.

Name ITS Human Resources

Telephone

Fax

Email Address

Address

Street 164 Columbia Tpke

City Rensselaer

State NY

Zip Code 12144

Notes on Applying To apply for this position, please submit a cover letter and resume clearly indicating how you qualify. Ensure that you include the vacancy ID in the subject of your email for prompt routing. Your Social Security number may be required to confirm eligibility.