University of Nebraska Central Administration Job Description

Transcription

1 General Infrmatin Wrking Jb Title: CSN Infrmatin Security Officer Psitin Number: 281 Emplyee s Name: University f Nebraska Central Administratin Jb Descriptin Jb Family: Infrmatin Security Department Name: Leadership Team - CSN Date f Last Update: Updated 12/2005 Jb Family Zne: Senir SAP Organizatin Unit Number: Title f Supervisr: Chief Infrmatin Officer SAP Persnnel #: Last Updated By: Name f Supervisr: Walter Weir Psitin Summary The IT Security Officer psitin will wrk t create effective infrmatin security architecture t ensure the implementatin f technlgy increases business effectiveness while maintaining an apprpriate level f integrity and prtectin. As the University develps mre cmplex, distributed and integrated infrmatin systems, traditinal security techniques are less effective and the underlying cntrl and security structure f these systems becmes mre cmplex. Infrmatin security architecture encurages the effective crdinatin f security cntrls and their administratin. It is used t recrd and cmmunicate the design, and t crdinate the activities f the system designers and builders. Wrking with the Central Administratin legal team, the CIO and the campuses, this psitin will be the primary IT psitin t enfrce cmpliance with such federal mandates, which requires a frmal written risk assessment and a risk management plan. This psitin will als develp a recgnized prtcl t determine security breaches, vilatins, and similar intrusins. Duties & Respnsibilities Indicate % f time spent and indicate with an * the duties & respnsibilities that are essential functins f this jb. Arrange this list f duties in rder f imprtance. Security Administratin: Develp and mnitr practices t ensure that the University s administrative and academic infrmatin is secure frm unauthrized access, prtected frm inapprpriate alteratin, physically secure, and available t authrized users in a timely fashin. Manage develpment and implementatin f glbal security plicy, standards, and guidelines. Lead in the develpment f specific cmpnents f an infrmatin security architecture including: create a risk assessment f all infrmatin systems and data necessary t evaluate the apprpriate and mst cst effective prtectin measures; develp and cmmunicate well defined plicies and prcedures fr security and infrmatin systems use t all persnnel; develp an nging cmpliance and measurement prcess fr infrmatin security standards;crdinate the establishment f well defined barriers and mnitring tls between trusted and untrusted netwrk envirnments; and assist in implementing develpment standards that ensure apprpriate design f cntrls and security int new applicatins and enhancements t critical applicatin. Develp a recgnized prtcl t determine security breaches, vilatins, and ther intrusins. IT Security Planning: Identify prtectin gals and bjectives cnsistent with University missin and strategic plan. Evaluate and make recmmendatins fr lng-range security planning in respnse t future systems, new technlgy, and new rganizatinal changes. Identify key security prgram elements. Security Awareness: Training and disseminatin f security plicies and practices as well as develping strategies and plans t prvide fr timely business resumptin in the event f serius disruptins. % f Time Essential Functins 50% + 30% + 20% 1

2 Zne Definitin Factrs Nature/Cmplexity f Wrk This psitin has cmplete respnsibility fr security decisins fr the University f Nebraska and CSN. The incumbent has t balance the needs f multiple campuses and diverse interests with the reality f limited resurces. Prblem Slving/Decisin-making Decisins/prblem reslutins require synthesis/analysis in the use f theries and accepted principles. Prgrams/prjects are gverned by brad bjectives, plicies and/r theries. Requires the use f creativity in dealing with unprecedented activities. Strategic Impact Actins and decisins in this jb have brad and cntinuing impact n the future f ne r mre functinal areas. The jb exerts a majr impact n decisins and final results affecting a majr university activity; and/r has accuntability fr financial and prgram/prject bjectives and verall successes. Errrs significantly interrupt business peratins, services and ptentially bth internal and external cnstituents. Knw Hw Strng prject management, critical thinking, analytical, verbal and written cmmunicatin skills. Strng interpersnal skills t deal with administratrs, and emplyees at all levels in the rganizatin. Experience with regulatry and cmpliance in a technlgy envirnment. Knwledge f IT security plicy and plicy administratin. Knwledge f implementatin requirements and impacts f data security legislatin. Develp and apply best practices. Experience in the develpment f infrmatin security plicies, intrusin respnse prcedures, business cntinuity & disaster recvery prcedures, risk analysis, and administratin f the peratins f a cmplex security infrastructure preferred. Technical Knw Hw: Knwledge and experience in IT hardware and sftware with expertise in the architecture, design and deplyment f in sme r all f the fllwing: security auditing, assessment & penetratin testing tls and prcedures, secure internets, intranets & extranets, identity management & distributed authenticatin systems/devices including smart cards & bimetric devices, security peratins administratin & management, SSL, S/MIME, Radius, LDAP, and IPSEC, Symmetric & public key cryptgraphy. Experience with security standards such as ISO 17799, NIST range bk, Micrsft site security handbk, GLBA security requirements and HIPAA security standards desired. Experience in the develpment f infrmatin security plicies, intrusin respnse prcedures, business cntinuity & disaster recvery prcedures, risk analysis, and administratin f the peratins f a cmplex security infrastructure preferred. Interactins This psitin wrks clsely with the CIO and University management. This psitin wrks clsely with cnstituents acrss all the university campuses as well as varius grups utside the rganizatin. Example: State f Nebraska IT department. Supervisin This psitin exercises Supervisin ver ne ther emplyee, the IT Security Analyst. This psitin receives limited in-direct, Supervisin* frm CIO and University management. The incumbent will be the expert in this area and will be expected t prvide the university with his/her expertise. Minimum Qualificatins LEVEL OF EDUCATION, YEARS & TYPE OF EXPERIENCE: Bachelr s degree in cmputer science, MIS, business administratin r related field plus 7-10 years demnstrated experience in managing systems prjects in a decentralized rganizatin, including 2-3 years f directly related experience in security management with knwledge f security technlgies, standards, and netwrking architectures. Equivalent cmbinatin f educatin, experience, and training that prvides the required knwledge, skills, and abilities may be cnsidered. Experience in higher educatin is preferred. Certified Infrmatin Security Prfessinal (CISSP) is desired. 2

3 Physical Requirements 1. General Physical Requirements Indicate the apprpriate respnse fr an eight hur day: Indicate intermittent r cnstant Circle the apprpriate number f hurs Intermittent Cnstant Sit x Stand x Walk x Drive Mtr Vehicle Explain Occasinally Between Over (less than 2 hrs ) 2-5 hrs 5 hrs 2. THIS POSITION REQUIRES: Squatting Bending x Kneeling Reaching! Overhead x! Frward x! Lw x Twisting x Crawling Climbing! Ladder! Stairs x! Other Walking n rugh grund Expsure t changes f temperature/humidity Expsure t dust/fumes/gases/chemicals Being near mving machinery Wrking frm heights 3. THIS POSITION REQUIRES EMPLOYEE TO: Indicate letter in apprpriate Space: LIFT=L CARRY=C PUSH=P PULL-PL Less than 2 hrs Up t 2 hrs Between 2-5 hrs Over 5 hrs lbs X lbs X lbs lbs * Over 100 lbs * If the psitin requires the emplyee t handle ver 50 lbs - please explain 4. POSITION REQUIRES USE OF HANDS OR SPECIAL TOOLS/EQUIPMENT FOR: RIGHT LEFT BOTH Keybarding X Filing X Other Explain: Operatin f a cmputer muse with their dminant hand. (Usually right). 3

4 Jb Family Zne Questinnaire In Each Sectin, please select ne answer that best describes yur jb: Knwledge Skills and Abilities: Requires the ability t understand and apply basic jb skills, knwledge f several wrk rutines and the ability t apply such rutines with minimal interpretatin. May pssess knwledge f ther, related wrk activities within wn functinal area. May require the peratin f rutine equipment/tls. [1] Requires the ability t understand, interpret, apply and cmmunicate infrmatin within a specializatin and the ability t apply limited analysis in the cmpletin f general functinal prcedures. May pssess knwledge f wrk activities utside functinal area. May require the peratin f mderately cmplex equipment/tls. [2] Requires the ability t utilize advanced infrmatin within a specializatin. Within specializatin, pssesses the ability t assess/ analyze situatins and make adjustments t achieve desired bjectives. Pssesses knwledge f wrk activities utside functinal area. May require the peratin f cmplex equipment/tls. [3A] Requires the ability t apply, integrate and cmmunicate extensive theretical infrmatin within a recgnized prfessinal field. Facilitates and/ r establishes the achievement f functinal area bjectives. Requires knwledge f all related functinal areas. May require the peratin f highly cmplex equipment/tls. [3B] x Integrates extensive theries and techniques within related r diverse disciplines t achieve results and/ r establish verall strategic directins. Requires wide-ranging administrative and/r specialized knwledge. May require the peratin f highly cmplex equipment/tls. [4] Prblem Slving/Decisin-making: Decisins/prblem reslutins are repetitive and simple and typically guided by standard perating plicies and prcedures/practices exist. Tasks are clear and specific t a single discipline. [1] Decisins/prblem reslutins require gathering/reviewing infrmatin frm several surces. Simple analysis f facts determines curse f actin t be taken within the limits f standard perating plicies and prcedures/practices. Tasks are varied and may crss several disciplines. [2A] Decisins/prblem reslutins require interpretatin, discretin and judgment based n precedent r standard perating plicies and prcedures. Tasks are diversified and may require sme creativity in dealing with unprecedented activities. [2B] X Decisins/prblem reslutins require synthesis/analysis in the use f theries and accepted principles. Prgrams/prjects are gverned by brad bjectives, plicies and/r theries. Requires the use f creativity in dealing with unprecedented activities. [3] Decisins/prblem reslutins require analysis and evaluatin f majr issues and curses f actin impacting the verall directin f the functinal area(s). Applies brad cncepts and experience in making imprtant decisins. May develp recmmendatins influencing lng-term plicies related t majr rganizatinal plans. [4] Interactins: Regular cntact invlves receiving and/r referring inquiries as well as giving r btaining rutine infrmatin relating t wrk being dne. Requires the use f cmmn business curtesy. [1] Regular cntact that invlves giving r btaining infrmatin as well as ccasinally exchanging advice and pinins. Requires the use f cmmn business curtesy, tact, discretin and sme persuasin t maintain cperative assciatins. [2] Regular cntact that invlves exchanging advice and pinins as well as ccasinally cnveying cnceptual ideas f a critical and/r lng-range nature. Requires the use f judgment, timing, and persuasin t gain cperatin in the face f differences f pinin r cntrversy. [3] X Regular cntact with majr Prgrams/Teams r individuals. Overriding jb requirement invlves cnveying cnceptual ideas regarding matters f critical and lng-range nature. Significant requirement fr 4

5 diplmacy, timing, and persuasin t gain cncurrence r cperatin n peratinal issues in the face f significant differences f pinin r cntrversy. [4] Supervisin Received: Supervised by prcedures r by supervisr thrugh peridic mnitring f prgress and perfrmance. May have latitude t determine sequence f wn wrk tasks t meet clearly established schedules. [1] Supervisin by prcedures r by supervisr thrugh peridic mnitring f prgress and perfrmance. Determines sequence f wn wrk tasks t meet established bjectives. [2A] General directin by supervisr by checking n cmpleted tasks. Establishes wn wrk schedule t achieve prgram bjectives. Makes recmmendatins t superir regarding efficient functining f prgram. [2B] Respnsible fr cnducting specialized assignments r develping prgrams under nly general directin and guidance. [3] X Extensive latitude t wrk independently in matters that have a brad effect n verall plicies, prgrams and/r areas f specializatin. [4] Supervisin Exercised: May prvide incidental guidance t thers. [1] Prvides functinal supervisin that is usually limited t assigning/reviewing wrk r may serve as wrk team leader. [2A] Serves as wrk team leader. Distributes, schedules, and mnitrs the prgress r wrk tasks f the prgram r prject. May be invlved in the recmmendatin f persnnel actins t manager. [2B] Supervises the wrk f a prject r prgram that may include hiring, discipline, transfers, prmtins, r salary changes within a functinal area. May integrate wrk f tw r mre prgrams r ne majr functin/r prject. [3] X Establishes perfrmance standards fr designated prgrams and/r areas f specializatin. Directs staff t include hiring, discipline, transfers, prmtins, and salary changes. [4] Impact: Actins and decisins in this jb are limited t the scpe f the jb, which primarily affect the immediate wrk grup, but ccasinally may extend beynd the immediate wrk grup. Errrs reflect unfavrably n the individual and may have an adverse impact n the functinal area. [1] Actins and decisins in this jb have an impact which affects the immediate wrk grup and als extends beynd the immediate functinal area. Errrs reflect unfavrably n the individual and the functinal area.[2] Actins and decisins in this jb have discernible impact t the shrt-term perfrmance f the Prgram/Team and exerts sme impact t its lng-term success. Errrs reflect unfavrably n the individual, the functinal area, verall business peratins and ptentially ther functinal areas. [3A] Actins and decisins in this jb have significant impact t the shrt-term perfrmance f the Prgram/Team and exert an impact t its lng-term success. The jb exerts a cnsiderable impact n decisins and final results typically affecting either an entire functinal area r a majr university activity; and may have unique accuntability fr financial and prgram r prject bjectives. Errrs effect business peratins, services and ther individuals which may require special interventins t crrect. [3B] X Actins and decisins in this jb exert brad and cntinuing impact n the future f ne r mre functinal areas. The jb exerts a majr impact n decisins and final results affecting a majr university activity; and/r has accuntability fr financial and prgram/prject bjectives and verall successes. Errrs significantly interrupt business peratins, services and ptentially bth internal and external cnstituents. [4] Summary: Zne Assignment= Senir Authrizatin: Name: Date: Human Resurces Sheryl Gartner Supervisr: Walter Weir 5