Information Security Compliance Analyst

Position Summary Metro is dedicated to shaping a better future for the greater Portland region. The Information Security Team is looking for an Information Security Compliance Analyst. This role serves as the primary support function to the CISO for Metro's information security governance, risk, and compliance (GRC) function, operationalizing and maturing the program on the CISO’s behalf while ensuring alignment with applicable federal, state, and local regulations, including privacy, data protection, breach notification, and public records requirements. Acting as a control owner delegate, this role ensures controls are properly defined, enforced, auditable, and aligned to business and regulatory requirements, with a clearly bounded (~30%) operational support component focused on control validation, audit readiness, and compliance alignment rather than primary ownership of security operations. Responsibilities Serve as the CISO’s operational extension for compliance and governance, translating security strategy into actionable policies, controls, and procedures, and preparing materials for executive reporting, audits, and regulatory reviews. Develop, maintain, and manage the full lifecycle of information security policies and standards, mapping them to applicable frameworks and coordinating periodic reviews with stakeholders across IT and business units. Act as control owner delegate for NIST CSF, CIS Controls, and PCI DSS, leading framework alignment, gap analysis, and PCI compliance activities including CDE scoping, evidence collection, and QSA coordination. Lead governance of the vulnerability management program, including policy definition, SLA tracking, compliance reporting, and risk acceptance decisions, partnering with the Cybersecurity Analyst as execution lead. Conduct compliance reviews of software and technology assets, maintain accurate asset inventories, and support third‑party/vendor security reviews to ensure audit readiness. Maintain and administer the enterprise risk register, support internal and external audits, and develop compliance metrics and dashboards to communicate risk and control effectiveness to leadership. Support incident response through documentation, evidence collection, and regulatory notification requirements, including secondary, after‑hours backup support for high‑severity security alerts in coordination with the Cybersecurity Analyst and SOC/MSSP providers. Collaborate with IT Operations, Infrastructure, and Application Teams to integrate security controls into operational processes, and assist in administering security tools (EDR, SIEM, email security, identity platforms) in support of compliance objectives. Contribute to system hardening and secure configuration baselines aligned with CIS Benchmarks, assist with IAM best practices, and coordinate security awareness and training initiatives. Develop and mature data classification, handling, and protection standards (including DLP and retention policies), support privacy impact assessments, and help mature Metro’s cybersecurity program through process improvement and continuous alignment with evolving threats and best practices. Attributes for Success Strong working knowledge of security and compliance frameworks (NIST CSF, CIS Controls, PCI DSS) with the ability to translate framework requirements into practical, auditable controls. Detail‑oriented and highly organized, with the discipline to manage policy lifecycles, evidence packages, and audit documentation accurately and on schedule. Comfortable operating independently while working under general direction from the CISO, exercising sound judgment on when to elevate versus resolve. Strong written communication skills, able to translate technical security concepts into clear policies, procedures, and executive‑ready reporting. Collaborative mindset with the ability to build effective working relationships across IT Operations, Infrastructure, Applications, and business stakeholders who don’t report to this role. Analytical and risk‑aware, able to assess control gaps, prioritize remediation efforts, and support risk acceptance discussions with sound reasoning. Comfortable with ambiguity and program building, given that governance structures, processes, and tooling are still actively being developed and refined. Basic technical fluency with security tools (SIEM, EDR, identity platforms) sufficient to support compliance monitoring without requiring deep engineering expertise. Reliable and responsive when serving as secondary, after‑hours backup for high‑severity alerts, with good judgment about when situations require escalation versus documentation. Genuine interest in continuous learning and staying current on evolving regulatory requirements, threats, and industry best practices in a public‑sector context. Minimum Qualifications 4–6 years of progressive experience in information technology, including at least 3–5 years in information security, IT security, or a compliance‑focused role. A bachelor’s degree in Cybersecurity, Information Technology, or a related field, or an equivalent combination of education, professional, volunteer, and lived experience that provides the necessary knowledge, skills, and abilities. Preferred Qualifications Experience in public sector or government environments. Relevant certifications such as CISA, CRISC (preferred for governance and risk), PCIP or equivalent PCI‑related certification (strongly preferred), Security+, SSCP, or GSEC (foundational, optional). Direct experience with PCI DSS compliance programs, including CDE scoping, SAQ, or ROC processes. Experience supporting cloud security compliance and governance activities in Azure, AWS, or similar environments (e.g., control mapping, configuration review, audit support). Familiarity with privacy considerations, data protection principles, and applicable Oregon state requirements. Experience with vendor risk management, third‑party assessments, or software asset compliance reviews. Familiarity with GRC tools or platforms used for risk management, control tracking, and audit management (e.g., ServiceNow GRC, Archer, or similar). Experience working with or overseeing third‑party security providers (e.g., MSSP/SOC) in a compliance or audit capacity. Hybrid Telework This position is designated as “hybrid telework.” You will be required to work onsite and, at times, have the option to work away from your assigned work location. The specific schedule and balance of onsite and telework will be discussed with the hiring manager at the time of offer. Employees must reside in Oregon or Washington to work at Metro. Please note that the designation of hybrid telework may be subject to change. Compensation and Benefits The full‑salary range for this position is step 1: $94,106.41 to step 7: $126,142.16. The appointment will likely be made between step 1: $94,106.41 and the equity range step 4: $108,947.96, in accordance with the Oregon Pay Equity Act requirements and Metro’s internal equity review process. Medical, dental and vision health insurance Paid sick leave Paid vacation, holiday, and other leave Paid parental leave Full contribution to Oregon PERS retirement No‑cost TriMet Hop Pass Employee Assistance Program Training opportunities Flexible schedules depending on position and department Equal Employment Opportunity All qualified persons will be considered for employment without regard to race, color, religion, sex, national origin, age, marital status, familial status, gender identity and expression, sexual orientation, disability for which a reasonable accommodation can be made, or any other status protected by law. Metro is committed to equal employment opportunity and complies with all applicable federal, state, and local civil rights laws. Metro employment decisions – including recruitment, screening, interviewing, selection, promotion, compensation, and separation – must not discriminate based on race, color, national origin, ethnicity, religion, sex, sexual orientation, gender identity, disability, age, veteran status, or any other protected class. Metro will gladly provide a reasonable accommodation to anyone whose specific disability prevents them from completing this application or participating in this recruitment process. Please contact the recruiter outlined in the job announcement in advance to request assistance. Under Oregon Law, qualified veterans may be eligible for veterans’ preference when applying for Metro positions. If you are a veteran and would like to be considered for veterans’ preference for this job, please provide qualifying documents as instructed during the application process. Contact: Carrie Gundermann – View email address on click.appcast.io #J-18808-Ljbffr City of Santa Fe Springs