Assistant Attorney 1/ Assistant Attorney 2/ Assistant Attorney 3 / Senior Attorney (NY HELPS)

Duties Description he Information Security and Data Privacy Office at NYSIF strives to protect the agency from ever-growing cyber threats. Additionally, the team helps ensure NYSIF is protecting the privacy and security of our customers/employees and stays compliant with the required laws and regulations. The Information Security and Data Privacy Office is responsible for protecting NYSIF’s electronic assets. NYSIF requires additional resources to address new and developing information security, artificial intelligence and privacy risks such as zero-day incidents, supply chain attacks and prompt injection attempts. Under the general supervision of the Chief Information Security and Privacy Officer, the incumbent will develop the skills and experience necessary to play a substantial role in the Information Security and Data Privacy Office. Responsibilities include, but are not limited to:

• Operationalize Privacy Procedures: Build out or execute privacy, artificial intelligence and security workflows across internal business units.
• Privacy & Security Impact Analyses: Perform and document Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) for projects impacting sensitive NYIF data.
• CISO/CPO Operational Support: Assist the CISO/CPO in updating internal security frameworks, privacy notices, and AI governance procedures to align with organizational risk thresholds.
• Incident Response & Documentation: Support the security team during incident response workflows, helping to assess data incident thresholds and evaluate regulatory notification triggers.
• Represents the Information Security and Data Privacy office at internal and external information security meetings and conferences to maintain awareness and evaluates the applicability of the latest information security techniques and tools to the agency’s security program.
• Regulatory Tracking: Monitor and interpret evolving state and federal insurance-specific privacy regulations (e.g., NAIC models, GLBA), cybersecurity rules, and emerging AI mandates.
• Cross-Functional Enablement: Develop into the primary privacy program liaison to internal business stakeholders, translating technical security and privacy requirements into clear, actionable business guidance.
• Participate in the continuous monitoring and protection of third party-vendor resources and determines events that require investigation and response.

Minimum Qualifications Minimum Qualifications:

For appointment to Assistant Attorney 1 (Grade 18):

• Law school graduation and/or eligibility for NYS Bar Admission*

For appointment to Assistant Attorney 2 (Grade 20):

• Admission to NYS Bar

For appointment to Assistant Attorney 3 (Grade 22):

• 12 months as an Assistant Attorney 2**; OR
• Admission to the NYS Bar and 12 months of subsequent satisfactory legal experience

For appointment to Senior Attorney (Grade 25):

• Reachable on current Civil Service eligible list for this title; OR
• One year of permanent, competitive class service as a Senior Attorney; OR
• One year of permanent, competitive class service in a title eligible for transfer under Section 52.6 of the Civil Service Law. 52.6 transfers may be considered only if you have passed the NYS Bar exam; OR
• 2 months as an Assistant Attorney 3**; OR

• Admission to the NYS Bar and 24 months of subsequent satisfactory legal experience*

• If you are appointed as an Assistant Attorney 1, you will be automatically advanced to Assistant Attorney 2 upon admission to the New York State Bar. If you are not admitted to the New York State Bar within two years of appointment, your appointment will be terminated.

** Admission to the New York State Bar and current registration to practice law in New York State is necessary for continued employment. Disbarment or loss of registration shall result in termination or suspension of employment.

Preferred Qualifications:

• Experience: Internship, externship, or professional exposure to information security and spotting potential litigation risks, artificial intelligence, data protection, or IT compliance environments and developing and maintaining cyber security and data privacy policies.
• Certifications: Interest in pursuing industry-recognized designations (e.g., IAPP CIPP/US, CIPM, AIGP) or security certifications (e.g., Security + or CISSP)

Please be advised that the New York State Insurance Fund (NYSIF) does not offer s…