Chief Information Officer

Transcription

1 Security manager Job description Job title Security manager Location Wellington Group Organisation Development Business unit / team IT Solutions Grade and salary range Pay Group 1, Pay Band 6 Reports to Chief Information Officer Welcome to Statistics New Zealand Who we are Statistics New Zealand Tatauranga Aotearoa is the country s main provider of official statistics. We also lead the Official Statistics System (OSS), which coordinates all statistics produced by government departments. Our aim is to inform society. Official statistics are used by government, local authorities, businesses, community groups, and individuals. They are useful for: keeping track of and understanding the state and progress of New Zealand steering the economy to improve the prosperity, security, and opportunities of New Zealanders informing debate and making decisions. Statistics NZ is a department of the New Zealand Public Service. Our duties and responsibilities are set out in the Statistics Act What we want to achieve The work we do contributes to creating an informed society using official statistics. The impact of our work and activities is that New Zealand gets the statistical information it needs to grow and prosper. Statistics 2020 Te Kāpehu Whetū Statistics 2020 Te Kāpehu Whetū is the organisation s programme of change for years leading up to It drives what we do and how we do it. It takes into account our internal environment (eg aging IT systems, current culture), and external factors like ensuring that we produce relevant future statistics and meet customer needs efficiently. The Māori name of the programme literally translates to star compass. This signifies the sophisticated navigation system necessary to get us to where we want to go. Our roles in New Zealand s Official Statistics System As leader of the OSS we: ensure that New Zealand gets the information it needs

2 advise the government on the policies, priorities, costs, and benefits of statistical activities coordinate statistical activities across government encourage other government departments to share ownership of the OSS and to reuse data define the objectives that different departments will focus on together ensure that official statistics provide value for money. As the country s main provider of official statistics we: report on trends, patterns, and changes to New Zealand s population, economy, society, culture, and environment ensure our statistics are relevant for our customers continually improve what we do and how we do it set an example for other government departments to follow ensure complete confidentiality for all our data maintain the highest level of credibility and integrity in our statistics. Our core values are: leading connecting communicating statistical excellence integrity confidentiality and data security. Our commitment to the Treaty of Waitangi Statistics NZ works to ensure that the statistical needs of Māori are identified and progressively met. This complies with the principles for government action on the Treaty of Waitangi.

3 Summary of your role As the security manager you will be accountable for leadership and management of the organisational security portfolio including security of our people, physical, information and application assets. This includes the immediate and long-term security frameworks, policies and strategies based upon the unique characteristics of Statistics NZ. The security manager role is also accountable for providing assurance and security support to the Chief Executive. Your broad role as a security manager will be to: manage the internal security strategy, policies and procedures develop, support and build capability around organisational security practices lead organisational security monitoring and reporting investigate security incidents act as Statistics NZ s security stakeholder lead and manage your team promote security awareness and build organisational capability build collaborative working relationships across Statistics NZ and the government sector communicate effectively. You will manage and maintain the Cyber Security Strategy and oversee the Information Security Management Framework as well as the annual budget planning for security initiatives. Relationships are an important part of this role. You will be need to work collaboratively, advise and report back to the Security Governance Committee and the Chief Information Officer. To be successful in your role you will need to work closely with your immediate and wider team, managers and staff, suppliers and contractors to ensure business and service continuity, and to provide comprehensive security support. You will also lead a team of one security advisor and be part of the IT Solutions Management team. You will be accountable for the work you do, and contribute positively to the values and outcomes outlined in our strategic plans, including Statistics 2020 Te Kāpehu Whetū, and our Statement of Intent. You will report directly to the Chief Information Officer.

4 Summary of your business unit Your role sits in the Statistics NZ security office. The purpose is to provide the Chief Executive with advice on security issues to provide assurance that physical and information security risks are being governed and managed appropriately and according to government policies. The security office will be accountable for: developing, co-ordinating, evaluating and implementing security strategy, policy, guidelines and procedures measuring, auditing and enforcing compliance with policy and standards training, mentoring and guiding others, so that adherence is inculcated in all our practices conducting assessments of potential threats to the security of information, employees, recommending necessary changes to current practices and initiate security projects investigating suspected breaches of policy and manage security incidents. About the IT Solutions group The security office is part of IT Solutions (ITS) Group within Organisation Development. ITS has the primary responsibility for the delivery of the IT role and functions within Statistics NZ. Three key aspects have been defined for the role all of which are required to ensure the provision of robust, client-focused IT services and infrastructure: Delivering responsive, reliable day-to-day IT services through the Operation Support Role Providing effective and efficient IT solutions through the Delivery Role Contributing to the long-range vision and strategic planning of Statistics NZ, in collaboration with organisational partners, through the Direction/ leadership role.

5 Detailed description of your role You will be To achieve this you will need to: As a result, we will see: expected to: manage the internal security strategy, policies and procedures develop and review an organisational security strategy that outlines Statistics NZ s high level plan to achieve a secure work environment perform regular reviews to identify gaps in policy and environment procedure develop and implement new policies, guidelines and standards related to people, facilities, data security, disaster recovery and business continuity, in consultation with stakeholders develop, support and build capability around organisational security practices develop procedures to follow in the event of a security breach including implementation of security incidents database. lead and promote the design and implementation of continuous improvement to systems, technology, processes, and procedures develop guidelines and requirements for practices that work across borders and internal activities such as data exchange and transfer define our borders so that all Statistics NZ practises can be classified into these development guidelines and requirements for practises that cross borders as well as for internal activities lead security awareness training throughout the organisation act as security stakeholder for internal and external forums, meetings and on projects (ie risk management committee) promote and lead compliance with procedures to change and delete staff accesses to data files, systems etc. This includes such things as Inland Revenue (IRD) data where special conditions apply. you develop and drive a security strategy that provides assurance across the business around the security of our people, information and physical security processes and policies that follow industry best practice. you lead development and implementation of security awareness initiatives across the organisation you and your team provide proactive advice and support across the organisation on security matters you recommend and implement improvements that add value to the organisation you keep your skills and your team s skills up to date and in line with best practice. lead audit projects, systems and regular monitoring and

6 organisational security monitoring and reporting identify and investigate security incidents act as Statistics NZ s security stakeholder practices identify risks and put robust solutions in place to manage these coordinate and advise on all security issues that arise across the organisation, including: o monitoring and reporting on the use of IT and physical environment, including the buildings and equipment such as faxes, printers and laptops o best practice for application developers o staff accesses to internal networks, data files, systems, s and internet plus, monitoring and compliance with procedures to modify and delete staff accesses. Access is granted on a need to know basis o release of aggregate statistics o overseeing physical testing of existing security o making recommendations on security best practice across operational divisions undertake other duties from time to time. proactively investigate all breaches of security work with key stakeholders to manager risks or breaches, including HR where a staff member may be involved. oversee Statistics NZ s Department Security Officer (DSO) responsibilities coordinate and oversee the InfoSec programme including the Cyber Security strategy provide reports for appropriate internal or external meetings and projects keep up with technical developments in security and make recommendations for implementation within Statistics NZ provide the security governance reporting of compliance with audit requirements timely investigations and reporting of breaches of security you use best practice monitoring, approaches and frameworks you make recommendations around how we monitor and report on our IT environment usage (including internal networks, and the web), particularly security and access to buildings you assess areas of risk and recommend actions to mitigate these. all risks and breaches of security are identified and managed effectively. you act as security stakeholder for Statistics NZ you provide security leadership internal and external to Statistics NZ.

7 lead and manage your team promote security awareness and build organisational capability build collaborative working relationships across Statistics NZ and the government sector committee with an agenda, key information or papers and strategic advice. lead the development, implementation and on-going review of an employee engagement action plan for your team make good choices in the selection, recruitment and development of your people provide coaching and support to build individual and team performance and capability implement meaningful performance and development plans for your people build staff capability to respond to Maori needs and interests foster the building and maintaining of a strongly engaged culture for your team provide regular and constructive feedback on performance champion health and safety work practices on behalf of Statistics NZ. lead the promotion and understanding of security and security practices for all leaders and staff provide high level advice and co-ordination around security activity across the organisation lead continuous improvement in security across Statistics NZ. build and develop highly credible and valued professional relationships, including connections with government security agencies build and maintain effective relationships with key individuals and groups from relevant sectors and organisations lead the implementation of common frameworks, standards, and methods and a collaborative, effective and engaged team the people in your unit understand their role and how it helps meet the aims of your unit and Statistics NZ you proactively engaging with your people and leading by example our corporate values in the actions, communications and connections across your team, and between them and their customers Statistics NZ meet our health and safety legal requirements. you build the presence and awareness around security across the organisation individuals understand security practices and proactively follow these highly effective and efficient policy and operational solutions around security at Statistics NZ best practice security solutions in place. you create and maintain strong, influential working relationships across the organisation you maintain active connections across government to share information, standards and best practice around security and security practices.

8 communicate effectively classifications across government establish and maintain a network of relevant peers externally to enable interchange of new information and practices collaboratively work with others to deliver on shared standards across government. communicate ideas and information to different audiences in plain English communicate clearly and concisely in all written and oral communications share information and knowledge with others in a proactive, timely way that fits the purpose seek peer review of written work. you be understood by all internal and external customers in both written and oral communication you write clearly and concisely, and follow the Statistics New Zealand plain English standard you communicate with peers and manager regularly.

9 Required qualities for your role Quality 1 The security manager needs to: Strategic agility look ahead, make credible predictions of likely future scenarios, and develop strategies and plans that address those scenarios Negotiating be an effective negotiator, achieving positive results without needing to make unacceptable concessions Integrity and trust be straightforward, honest, and trustworthy Ethics and values always behave ethically, and demonstrate support for the organisation's values Innovation management encourage innovative thinking and is good at assessing the potential of new ideas Decision quality make sound decisions based on analysis, wisdom, experience and judgement Developing direct reports and others actively work to develop direct reports and others, making good use of the organisation's development policies, procedures and tools Peer relationships be a team player with a strongly collaborative approach Approachability be approachable, friendly and picks up on what people are thinking and how they are feeling Action oriented be proactive and energetic, welcome challenges and seize opportunities Problem solving recognise problems, analyses them, then solves them Dealing with ambiguity be flexible and deal confidently and positively with change and uncertainty Customer focused be focused on understanding the needs of customers and on delivering value to them Drive for results consistently deliver results beyond expectations Learning on the fly be open to the unfamiliar, ready to experiment and quick to learn Interpersonal savvy relate well to all kinds of people and build effective relationships. Required qualifications and experience be knowledgeable on o all aspects of security, including strategy and technology o national and international policies and procedures o and have an in-depth understanding of compliance, privacy and risk have significant experience and/or education. We have a strong preference for applicants to have: o a National Diploma in Security (Level 6) or o a minimum 6-8 years security related experience with GIAC, CISM, CISA, CISSP, SABSA Practitioner or o an equivalent certification or qualification. have a proven background in information security leadership within a complex organisation be able to achieve a security clearance of up to Secret.

10 Definitions CISO GIAC CISM CISA CISSP SABSA Chief Information Security Officer Global Information Assurance Certification Certified Information Security Manager Certified Information Systems Auditor Certified Information Systems Security Professional Sherwood Applied Business Security Architecture Our workplace: your workplace Statistics NZ endeavours to provide a working environment that encourages the development of an individual's potential and their contribution to the organisation, by offering challenges and opportunities. We value staff from diverse cultural backgrounds and staff with active interests outside work. We provide a supportive environment so that individuals can balance their working life and personal life. This is achieved through policies for work and family life, equal employment opportunities (EEO), and a healthy and safe work environment. All departmental offices are smoke-free. We are committed to developing an EEO work place. All staff are required to comply with our EEO policy. Discrimination on the grounds of race, colour, sex, nationality, ethnic origin, sexual orientation, religion, disability, family, age, and marital status is not tolerated. 1 Copyright 1992, 1996, by Lominger Limited, Inc. a Korn Ferry Company. ALL RIGHTS RESERVED. These qualities are derived from the LEADERSHIP ARCHITECT Competency Sort Cards developed and copyrighted by Robert W. Eichinger and Michael M. Lombardo for Lominger Limited, Inc. Without the prior written permission of Lominger Limited, Inc., no part of this work may be used, reproduced or transmitted in any form or by any means, by or to any party outside of Statistics New Zealand.