Security Compliance Analyst

We are seeking a Senior Security & Compliance Analyst to provide Information Technology (IT) staff augmentation services in support of the Department's Office of Information Technology (OIT), Information Security function. This is a full-time position responsible for supporting the Department's information security governance, compliance, risk management, and security operations initiatives. The selected candidate will report to the Information Security Manager (ISM) and work closely with the Office of Information Technology, the Office of General Counsel, and various Department program areas. The individual may also serve as a liaison with the Florida Digital Service and external solution providers on information security matters. All work products are subject to review and approval by the Information Security Manager. Key Responsibilities Author and maintain information security policies, standards, procedures, and related documentation. Perform hands-on implementation, validation, and assessment of security controls. Apply and map security control frameworks including NIST SP 800-53 and NIST Cybersecurity Framework (CSF) to the Florida Cybersecurity Standards (Rule 60GG-2, F.A.C.). Conduct security risk assessments, identify control gaps, prioritize remediation activities, and document risk decisions for management review. Produce audit-ready policies, procedures, security assessments, and management response documentation. Support Microsoft 365 and Microsoft Defender security operations, including endpoint security, vulnerability management, identity and access management, and incident response activities. Communicate security risks, remediation strategies, and technical recommendations to executives, legal counsel, and non-technical stakeholders. Collaborate with internal IT teams, Department leadership, legal staff, and external vendors to support enterprise information security initiatives. Minimum Qualifications Experience Minimum of four (4) years of combined IT and information security experience with broad exposure to systems analysis, application development, database design and administration, including one to two (1–2) years of experience in information security and knowledge of security issues, techniques, and implications across multiple computing platforms. Minimum of seven (7) years of experience across multiple information security disciplines, including both Governance, Risk, and Compliance (GRC) and hands-on security operations. Demonstrated experience developing information security policies and standards. Experience implementing security controls based on NIST SP 800-53 and/or the NIST Cybersecurity Framework (CSF). Experience performing security risk assessments and supporting internal and external security audits. Ability to work onsite at the Department's Tallahassee, Florida location. Remote work may be approved occasionally on an ad hoc basis with prior approval; this is not a hybrid or permanent remote position. Travel expenses are not reimbursable. Required Skills Broad expertise across information security governance and operational security. Strong understanding of security control frameworks, including: NIST SP 800-53 NIST Cybersecurity Framework (CSF) Florida Cybersecurity Standards (Rule 60GG-2, F.A.C.) Ability to assess security risks, evaluate control effectiveness, prioritize remediation efforts, and document risk acceptance decisions. Strong technical writing skills for developing policies, procedures, assessments, audit documentation, and management responses. Hands-on experience supporting Microsoft 365 and Microsoft Defender environments, including: Vulnerability Management Identity and Access Management (IAM) Excellent verbal and written communication skills with the ability to explain technical security concepts to non-technical audiences. Education & Certifications Education Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field, or equivalent work experience. Preferred Industry Certifications Certified Information Systems Auditor (CISA) Certified in Risk and Information Systems Control (CRISC) Certified in Governance, Risk and Compliance (CGRC/CAP) Certified Information Security Manager (CISM) Certified Information Systems Security Professional (CISSP) #J-18808-Ljbffr