Security Analyst II

Security Analyst II

The Security Analyst II is responsible for building and maturing PBS's governance, risk, and compliance programs, including risk and vulnerability management, policy and procedure development, GRC tool configuration, automation, AI governance, and business continuity, while continuing to provide hands-on security operations support. This role is approximately 75% Governance, Risk & Compliance (GRC) program development and 25% security operations, including incident response and threat detection across cloud and on-prem environments.

Key responsibilities will include, but are not limited to:

• Building and operating the enterprise cyber risk management program, including risk identification, assessment, treatment, and reporting aligned to NIST SP 800-53 Rev 5
• Building and maturing the vulnerability management program, including scanning coverage, risk-based prioritization, remediation tracking, and metrics/reporting
• Developing, updating, and maintaining cybersecurity policies, standards, and procedures, and driving their adoption across the PBS ecosystem
• Configuring and administering GRC tooling, including workflow design, control mapping, and integrations with security and IT platforms
• Designing and implementing automation to streamline GRC workflows (e.g., evidence collection, continuous control monitoring, and risk and compliance reporting)
• Supporting the AI governance program, including the secure deployment, monitoring, and testing of AI, aligned to the NIST AI Risk Management Framework
• Developing and maintaining business continuity and disaster recovery plans, documentation, and tabletop exercises
• Supporting audits, assessments, and compliance activities, including evidence gathering and remediation tracking
• Monitoring information systems and assets to identify cybersecurity events and verify the effectiveness of protective measures
• Detecting anomalous activity and assessing the potential impact of events
• Executing incident response, containment, and recovery processes, and coordinating response activities with internal and external stakeholders (e.g., MSSPs and vendors)
• Incorporating lessons learned from incidents into detection, response, and recovery processes
• Streamlining security operations workflows using AI

Requirements for success:

Experience requirement: Minimum of 10 years' experience in cybersecurity and/or information technology Minimum of 5 years' experience working in cybersecurity GRC (e.g., risk management, compliance, policy and governance, business continuity) Minimum of 4 years' experience working as a security analyst Minimum of 3 years' experience working as a systems engineer or administrator Education and/or certification requirement: CISSP, CISA, CISM, CRISC, CGRC, or equivalent GRC-focused certifications desired GCIH, GCIA, GMON, GCED, or equivalent GIAC defense focused certifications desired Certifications by EC-Council, ISC2, Cisco, Microsoft, Fortinet, CompTIA, Offensive Security, etc. to be considered based on relevance to defensive cybersecurity operations Bachelor's Degree in a related field such as cybersecurity, information technology, or computer science; equivalent combination of education and experience may be considered Skills and abilities: Ability to design, implement, and continuously improve GRC programs and processes, translating frameworks such as NIST SP 800-53 Rev 5, NIST CSF, and NIST AI RMF into practical policies, controls, and procedures Ability to configure, integrate, and administer GRC platforms and build automated workflows across security and IT systems Ability to participate as a technical lead on all projects requiring cybersecurity expertise and consultation Ability to deploy, integrate, configure, and maintain systems which comprise the overall cybersecurity technology stack Ability to support incident response activities in coordination with internal teams and Managed Security Services Partners (MSSPs) Ability to communicate complex cybersecurity and risk concepts in a clear and concise manner for laypersons unfamiliar with cybersecurity and/or IT concepts Desire and ability to help drive organizational adoption and buy-in of cybersecurity policies and standards across the PBS ecosystem Eagerness to develop, grow, and maintain strong inter-team relationships across the business to aid in the accomplishment of the PBS mission Preferred qualifications: Experience configuring and administering GRC platforms (e.g., ServiceNow GRC/IRM, Archer, OneTrust, or similar) and building automation and reporting on top of them Strong working knowledge of NIST SP 800-53 Rev 5, NIST CSF, NIST AI RMF, CIS Benchmarks, and business continuity/disaster recovery planning Working knowledge of security operations technologies and concepts including DFIR, SIEM, SOAR, EDR, IAM, PAM, DLP, NGFW, IDS/IPS, CASB, MITRE ATT&CK, MSSPs, vulnerability management, application security, and cloud security (IaaS & PaaS) Fundamental knowledge of scripting and automation (e.g., PowerShell, Python, JavaScript), email security, MDM, OWASP, malware analysis, LOLBAS, WAF, DNS, Linux, Windows, and MacOS