Senior IT Risk and Compliance Analyst

Apply now Job no: 503864 Work type: Regular Full-Time Location: Washington, DC Capability Area: IT DSS Security and Compliance

JOB SUMMARY

NORC at the University of Chicago seeks Senior IT Risk and Compliance Analyst to join our DSS Security and Compliance group. The successful candidate will be part of an IT Risk and Compliance team, expert in government security standards and regulations. The team is responsible for specifying, documenting, validating, and maintaining IT security & privacy controls to ensure compliance with security requirements of clients (principally Government) and corporate standards for data and systems integrity. The team develops and implements tools and processes to measure and track IT risk and compliance metrics. The team provides guidance to IT functional teams on risk and compliance as it pertains to system development, documentation, testing, monitoring, and reporting, and conducts risk assessments and security impact analyses of information systems.

LOCATION

This is a hybrid role based in our Chicago Loop or Washington, DC office, with a minimum of six days per month in the office. Remote candidates may also be considered. Qualified applicants must be U.S. citizens due to security clearance requirements for projects.

DEPARTMENT

Digital Services & Solutions Security & Compliance

RESPONSIBILITIES

Specify, document, validate, and maintain IT security & privacy controls to ensure compliance with client and corporate data integrity standards. Develop and implement tools and processes to measure and track IT risk and compliance metrics. Provide guidance to IT functional teams on risk and compliance as it pertains to system development, documentation, testing, monitoring, and reporting. Assist in conducting risk assessments and security impact analyses of information systems.

REQUIRED SKILLS

Education and Certifications : Bachelor’s degree in computer science, Information Technology, or a related field (or equivalent experience). Professional certifications such as CISSP, CISM, or similar. General Experience : Minimum of 4 years in information security roles, emphasizing security architecture and engineering solutions. Proven experience performing network penetration testing, vulnerability scans, and configuration analysis; experience overseeing project penetration testing activities; preferred experience as an ISO for federal programs and projects; experience coordinating communications across vendors, internal stakeholders, and program owners; experience using CSAM. ATO Experience : In-depth knowledge and experience guiding information systems through the Authorization to Operate (ATO) process; proficiency in navigating the complex landscape of ATO processes and obtaining authorizations; extensive knowledge of steps involved in the ATO process, ensuring compliance with NIST and FISMA; proven ability to streamline and expedite ATO timelines; expertise in developing and presenting comprehensive ATO documentation; demonstrated skill in addressing and mitigating security risks identified during the ATO process; exceptional communication skills to articulate ATO requirements, progress, and challenges. Compliance and Documentation : Thorough understanding and experience with government regulations and standards related to information security; in-depth knowledge of security compliance checks and the ability to perform audit activities; experience reviewing and validating security documentation, including system security requirements definition and System Security Plans; experience conducting penetration testing across multiple vendors, contractors, and consultants. Communication and Guidance : Strong communication skills to guide customers on information security policies and regulations; ability to effectively communicate complex security concepts to both technical and non-technical stakeholders; experience conducting incident response across vendors, stakeholders, and program owners; coordinating response plans, overseeing technical response, and collaborating with legal, technical, and communications teams.

SALARY AND BENEFITS

The pay range for this position is $97,000 - $120,000. Regular staff are eligible for NORC’s comprehensive benefits program, including: Generously subsidized health insurance, effective on the first day of employment Dental and vision insurance A defined contribution retirement program, along with a separate voluntary 403(b) retirement program Group life insurance, long-term and short-term disability insurance Benefits that promote work/life balance, including generous paid time off, holidays; paid parental leave, bereavement leave, tuition assistance, and an Employee Assistance Program (EAP).

EEO STATEMENT

NORC is an equal opportunity employer. NORC evaluates qualified applicants without regard to race, color, religion, sex, gender, national origin, disability, status as a protected veteran, sexual orientation, and other legally protected characteristics. #J-18808-Ljbffr NORC at the University of Chicago