Risk & Cyber Security Manager

This is not a Civil Service Position.  DWSD employees are subject to provisions of Court Orders entered in United States District Court, Eastern District of Michigan, Southern Division, Case No. 77-71100 with regard to certain terms and conditions of employment. DWSD does not honor reversion rights for internal candidates. 

Ensures adequate Governance and Compliance results with internal Technology Policies and Standards across all business units, including management of risk mitigation plans across all business units. Develops, tests, and maintains systems' security .Analyzes security of operations and integrated systems. Performs vulnerability assessments of systems and networks. Identifies where they deviate from acceptable configurations or applicable policies.

The Manager – Cyber Security and Risk is responsible for establishing and maintaining the Detroit Water and Sewerage Department’s enterprise-wide information technology risk and security management program ensuring that technology and information assets are highly available and adequately protected and to effectively translate business objectives and risk management strategies into specific security processes enabled by security technologies and services. This role requires continuous collaboration with the City of Detroit’s Department of Innovation and Technology (DoIT) on infrastructure and enterprise applications to ensure secure and reliable services. The Department of Innovation and Technology (DoIT) has primary responsibility for security information and event management (SIEM), Security Awareness and Vulnerability Scanning.

Essential Job Functions

Identifying, evaluating, and reporting on technology and security risks in a manner that meets compliance and regulatory requirements, and aligns with and supports the risk posture of the enterprise. Proactively work with the DWSD and DoIT and other functional areas to implement practices that meet defined policies and standards for effective and efficient technology risk management and information security. Develop, implement, and monitor a comprehensive enterprise information security and risk management program ensuring the integrity, confidentiality and availability of information owned, controlled, or processed by the Department.

Institute a Cyber Security Incident Response Team comprised of key technical personnel from the various units and areas of DWSD and DoIT. Keep up to date of DWSD information security incidents and act as DWSD’s primary control point during significant information security incidents.

Develop a technology risk and security management framework and governance structure. Develop, implement, and maintain general CIS Critical Security Controls for DWSD. Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the DWSD Security program, facilitate appropriate resource allocation, and increase the maturity of the security posture.

Provide regular reporting on the status of the technology risk and security program to DWSD Executive Staff and Board of Water Commissioners. Develop, maintain, and publish up-to-date information security policies, standards and guidelines including but not limited to general computer controls, general application controls and application specific controls.

Related Job Functions

Oversee the approval, training, and dissemination of security policies and practices in coordination with DoIT. Create, communicate, and implement a risk-based process for vendor risk management.

Create and manage information security and risk management awareness training programs for all employees, contractors, and other approved system users. It is key to have a holistic approach to cybersecurity from a City Enterprise approach, so applicant will be point of contact between DWSD and DoIT for security related items.

REQUIRED KNOWLEDGE, SKILLS AND ABILITIES
•    Plan security activities within the development life cycle, estimate costs and duration, their impacts related to tender/project execution and identify training needs.
•    Cybersecurity context and Cybersecurity Risk Analysis.
•    Cybersecurity Architecture Definition and requirement allocation.
•    Cascading requirements to suppliers, Managing Third Parties Risks.
•    Application of Cybersecurity Assurance Level.
•    Definition of Cybersecurity Operating Procedures.
•    Evaluation of the Tender/Project achieved Cybersecurity level.
•    Manage the budget of the project regarding Cybersecurity.
•    Manage the subcontractors in his/her perimeter.
•    Provide support during technical design meetings for cybersecurity activities.
•    Report on Tender / Project Cybersecurity status.
•    In case of external Cybersecurity audit, manage the relationship with auditors and establish lessons learned.
•    Knowledge of main Cybersecurity standards and regulations, such as ISO 2700X, 62443, NIST, NIS, and IEC 62443.
•    Architecture concepts and techniques of systems and networks, operating systems, and associated programming languages.

Minimum Qualifications

• Bachelor’s degree in Information Technology, Engineering, Computer Science, Computer security, or related discipline A minimum of seven (7) years of broad Information Technology (IT) or Operational Technology (OT) experience including applications, infrastructure, operations, and controls.
• A minimum of three (3) years of project management and operational experience gained through progressively more responsible positions.
• Certifications: CISA, CRISC, CISSP, ISA/IEC 62443 or CISM desired
• Master’s Degree and/or Professional Accreditation in related functional field preferred

Physical Requirements:

Environment Working Requirements:
Work is performed within an office, plant environment, remote sites, or other locations within the DWSD Service Area.
 
Other Requirements:
Must have a valid Michigan Driver’s License

 Ability to work irregular hours, to commute to DWSD facilities and work sites, and respond to after hours emergencies and on-call responses.

The above statement describe the general nature and level or work performed by
employees assigned to the class. Incumbents may be required to perform job-related responsibilities and tasks other than those stated in this specification. Specific job duties may vary from position to position. Employees in this class are required to undergo
alcohol and drug screening and are subject to a criminal background investigation.