Information Security Officer, Threat Management

**Position Details**:

- Position Information**Position Title**
- Information Security Officer, Threat Management

**Department/Unit**
- Information Security

**Location**
- Halifax, Nova Scotia, Canada

**Posting Number**
- S095-24

**Employee Group**
- DPMG

**Position Type**
- Regular, On-Going

**Duration of Contract (if applicable)**

**Employment Type**
- Full Time

**Full-time Equivalency (FTE)**
- 1.0 FTE

**Salary**
- Commensurate with training and experience.

**Classification**
- ADM-07

**Provisional Statement**
- This is a provisional classification. Formal regular review classification procedures may be initiated at any time by the incumbent or supervisor after the incumbent has worked a minimum of six months in the role._

**About Dalhousie University**
- Dalhousie University is Atlantic Canada’s leading research-intensive university and a driver of the region’s intellectual, social and economic development. Located in the heart of Halifax, Nova Scotia, with an Agricultural Campus in Truro/Bible Hill, Dalhousie is a truly national and international university, with more than half of our almost 21,000 students coming from outside of the province. Our 6,000 faculty and staff foster a vibrant, purpose-driven community, that celebrated 200 years of academic excellence in 2018.

**Job Summary**
- Information Technology Services (ITS) is dedicated to a constructive, team-orientated environment, gathering varied perspectives, sharing knowledge, and building effective partnerships that enable our partners to achieve their goals by advising, providing solutions, and delivering service excellence in alignment with the University’s mission and goals. Reporting to the Chief Information Security Officer (CISO), the Information Security Officer, Threat Management will be responsible for leadership in the development of threat visibility, incident management standards and playbooks, major incident coordination, and vulnerability management.

**Key Responsibilities**
- Engage with a broad range of technical groups inside and outside of the university to advise on developing threat and vulnerability risk assessment visibility, operational incident methods, and governance/compliance reporting.
- Assess and manage incident response quality control on university information systems and information assets. Audit actions and outcomes in real-time. Provide tactical and strategic course corrections to all involved university teams.
- Lead the design, development and implementation of new incident management standards, procedures, and playbooks in collaboration with key stakeholders and service providers.
- Manage strategic coordination of incident response efforts for major incidents, including coordination of all operational teams across the university units.
- Develop vulnerability management standards, KPIs, and vulnerability/risk visibility within the organization, coordinating with CISO on institutional efforts.
- Develop methods, tools, and intelligence, and consult across the university community regarding threat visibility. Deliver education on vulnerability management, threat detection, and threat methods.

**Note**
- The successful applicant will be eligible for hybrid work (combination of in-person work on campus and remote work) as agreed by all parties based on operational requirements and university guidelines.

**Required Qualifications**
- Undergraduate degree in relevant field (e.g Information Security, Information Management) plus a minimum of seven to ten years relevant experience (or equivalent combination of training and experience).
- Completion of industry security certifications (GIAC/ISC2 or related security designations), or a willingness and ability to achieve relevant information security designations within 3-5 years.
- In-depth knowledge of IT practices, processes, controls, risk and governance frameworks as well as a broad knowledge of IT support environments, IT infrastructure, endpoint device management, networks, and cloud service environments as well as demonstrated commitment to ongoing formal and self-study to remain current with best practices in multiple disciplinary areas.
- Experience relevant to information security systems and implementation and the demonstrated ability to learn technically complex environments.
- Proven ability to problem-solve, and assess risks on complex, multidimensional initiatives and projects with excellent judgement, initiative, and follow-through.
- Demonstrated solid communication (verbal and written), negotiation and presentation skills.

**Assets**
- Experience in a complex, multi-platform IT environment.
- Demonstrated experience in large-scale incident management.
- Experience involving engagements with senior leaders and decision-makers.
- Experience in a postsecondary or public-sector environment.

**Job Competencies**
Self-Awareness & Professionalism
- Integrity
- Respect & Inclusion
- Thinking and Acting Strategically
- Relationship