Information and Security Officer

• 5109753

• Henrico, Virginia, United States, 23228

• VA Cannabis Control Authority

• Information Technology

• Full-Time (Salaried)

• Closing at: Aug 26 2026 - 23:55 EDT

• VA Cannabis Control Authority

Title: Information and Security Officer

State Role Title: Salary Non-Specified

Hiring Range: Hiring range for this position is $116,077.60 - $133,489.24, commensurate with education and experience

Pay Band: UG

Agency: VA Cannabis Control Authority

Location: VA Cannabis Control Authority

Agency Website: https://cca.virginia.gov/

Recruitment Type: General Public - G

Job Duties

Program Leadership

• Leads the Virginia Cannabis Control Authority cybersecurity program in support of program and administrative information systems and technology.

Policy, Compliance and Audit

• Develops and maintains cybersecurity policies and standards for Authority information technology infrastructure and data.
• Implements and maintains one or more risk management frameworks in order to protect all information technology infrastructure and assets from external and internal threats.
• Ensures CCA cybersecurity compliance and serves as a key point of contact with Authority affiliated audit and compliance personnel.
• Maintains and reviews commercial and governmental IT policies, standards and guidelines, ensuring the Authority follows established best practices.

Security Awareness and Training

Oversees the information security training program for Authority employees and manages ongoing security awareness and role-based security training.

Risk Management, Security Operations, Projects, and Incident Response

• Manages IT security operations, overseeing cybersecurity monitoring, detection, and management platforms. Identifies risks and vulnerabilities, engaging with stakeholders in security responses.
• Participates in the Authority Change Management process and evaluates changes for security risks.
• Assists in the development of a comprehensive continuity of operations and disaster recovery plans.
• Manages crisis situations, which may involve complex information security issues and leads events through completion including overseeing and reporting all forensic activity.
• Develop and maintain very positive and professional customer service and/or relations within the Authority and with all constituencies to include citizens, patients, practitioners, licensees, and contractors. Demonstrates a positive and professional attitude and treats everyone with dignity and respect.
• Safety issues are reviewed and communicated to ensure a safe and healthy workplace and a reduction in work-related absence.

Other duties as assigned

• Follow workplace safety regulations and adhere to applicable standards, processes, and programs established for your position.
• Report unsafe work conditions to your supervisor.
• Immediately report work-related incidents to your supervisor and participate in accident investigation requests.

Minimum Qualifications

• Possesses working knowledge of all areas within the IT department including information security, systems, network infrastructure, identity management, application development, and endpoint security.
• Significant knowledge and awareness of security trends, legislation, and policy.
• Comprehensive knowledge of current information security threats, weaknesses and vulnerabilities and good working knowledge of zero-day exploits.
• Ability produce and manage IT security corrective action plans.
• Demonstrated ability to model professional integrity and behavior.
• Excellent organization and planning skills.
• Superior communication skills, including the ability to write complex technical documentation for varied audiences

Required Education and Experience

• Master’s Degree or a Bachelor’s Degree, or equivalent combination of education and professional experience.
• Experience building and maintaining information security programs.
• In-depth experience participating in incident response planning and security breach investigations.
• Demonstrated experience delivering security awareness and training programs.
• Experience evaluating, administering and executing enterprise security programs

Additional Considerations

Preferred (Optional) Education and Experience

• Experience leading, supervising, and facilitating state government technical security teams.
• Familiarity with continuity of operations, business impact analysis, disaster recovery, and risk management frameworks.
• Experience serving as incident commander during information security incidents.

Special Instructions

You will be provided a confirmation of receipt when your application and/or résumé is submitted successfully. Please refer to “Your Application” in your account to check the status of your application for this position.

Contact Information

Name: VCCA Recruitment Team

Phone: 804-653-9735

Email: [email protected]

In support of the Commonwealth’s commitment to inclusion, we are encouraging individuals with disabilities to apply through the Commonwealth Alternative Hiring Process. To be considered for this opportunity, applicants will need to provide their AHP Letter (formerly COD) provided by the Department for Aging & Rehabilitative Services (DARS), or the Department for the Blind & Vision Impaired (DBVI). Service-Connected Veterans are encouraged to answer Veteran status questions and submit their disability documentation, if applicable, to DARS/DBVI to get their AHP Letter. Requesting an AHP Letter can be found at AHP Letter or by calling DARS at 800-552-5019.

Note**:** Applicants who received a Certificate of Disability from DARS or DBVI dated between April 1, 2022- February 29, 2024, can still use that COD as applicable documentation for the Alternative Hiring Process.

Reasonable accommodations are available to individuals with disabilities during the application and/or interview processes per the Americans with Disabilities Act. Please call (804)653-9490 for assistance.

The Commonwealth of Virginia is an Equal Opportunity Employer. It is the policy of the Commonwealth of Virginia to prohibit discrimination on the basis of race, sex, color, national origin, religion, sexual orientation, gender identity or expression, age, veteran status, political affiliation, disability, genetic information, pregnancy, childbirth or related medical conditions in the recruitment, selection, and hiring of its workforce.