Associate Director, IT Security

The Associate Director, IT Security plays a vital role in securing the College’s digital assets, including proprietary and sensitive information. The Associate Director, IT Security is responsible for establishing and maintaining an enterprise IT security strategy through strategic initiatives, policy development, architecture design, implementation and management of technology solutions and training programs. Other responsibilities include the selection of appropriate security solutions and managing the budget. The Associate Director, IT Security is responsible for the ongoing operations of security monitoring and remediation, adoption of security best practices and enforcement within the college. The Associate Director, IT Security is responsible for maintaining and testing of a robust cybersecurity incident response plan, including technical playbooks, in the event of a significant cyber-related event.

**REPORTING RELATIONSHIPS**
The Associate Director, IT Security reports to the Chief Information Officer.
Reporting to the Associate Director, IT Security are:

- 1 FTE - IT Security Analyst - CUPE
- 1 FTE - IT Senior Network Administrator - CUPE

The Associate Director, IT Security frequently meets and collaborates with senior leadership and workplace leaders across the college. The Associate Director, IT Security, is an integral member of the ITS Management Team and is expected to work in close partnership and cooperation with the Information Technology Services management team. This partnership includes effective priority setting and balancing of resources to meet overall College objectives. Develops and maintains effective, positive relationships with all clients of IT services at the College.

**ESSENTIAL JOB FUNCTIONS**
Strategy & Planning
- Is accountable for the security architecture design and the College’s IT security strategy, guided by CIS Controls and the Province of B.C.’s Defensible Security Framework and in compliance with other relevant security and privacy requirements (PCI-DSS, FIPPA, etc.).
- Develop and maintain a cyber security awareness training program, including phishing cyber security workshops and end-user training.
- Create, maintain and promote the College’s security documentation (policies, standards, baselines, guidelines and procedures).
- Maintains the development and implementation of a cyber security incident response program that ensures that all stages of incident lifecycle management are followed: preparation, detection and analysis, containment and eradication and recovery, and post-incident activity.
- Leads the IT Security Team and provides clear direction for goals and associated actions.
- Ensures that Payment Card Industry Data Security Standards (PCI-DSS) compliance is maintained and works closely with the IT Infrastructure team to enforce controls concerning card holder data to reduce credit card fraud.
- Perform threat-hunting exercises and stay current with relevant threat actors and actor groups to ensure the College understands the current risks and trends in targeted higher education attacks.

Acquisition & Deployment
- Maintain up-to-date knowledge of the IT security industry including awareness of new or revised security solutions, improved security processes and new attack and threat vectors.
- Accountable for the selection and acquisition of technical security solutions and enhancements to improve overall enterprise security as per the College’s existing procurement processes.
- Manage the deployment, integration and configuration of new security solutions and of any enhancements to existing security solutions in accordance with standard best operating procedures and the College’s security policies and standards.

Operational Management
- Ensure the confidentiality, integrity and availability of the College’s systems, network and data.
- Ensure the enforcement of security policies, procedures and standards.
- Leads and coordinates an appropriate level of response to cyber security events, alerts and incidents.
- Accountable for security-related investigations and communicates frequently with the CIO and ITS management team.
- Responsible for the design and execution of vulnerability assessments, penetration tests and security audits.
- Ensures regular cyber security awareness training for all employees is performed to ensure consistently high levels of compliance with security policies, procedures, standards and general security best practices.
- Perform regular assessments and audits of existing security systems, tools and control, ensuring that we are maximizing the use and value of our investments.
- Assist in the development and testing of the ITS Disaster Recovery Plan and where appropriate, assist in the College’s Business Continuity Plan.
- Assist the ITS Management Team, Privacy Officer and functional workplace leaders in providing recommendations related to privacy and the development of Privacy Impact Assessments (PIAs).
- En