Information Security Analyst

Information Security AnalystWe are seeking an experienced Information Security Analyst to support and strengthen the City's cybersecurity, risk management, and compliance programs. This role will serve as a key contributor in developing security governance frameworks, conducting risk assessments, supporting security operations, and ensuring regulatory and standards alignment. The ideal candidate will bring deep expertise in cybersecurity analysis, risk management, incident response, and security technologies, along with the ability to collaborate across technical and non-technical stakeholders.Key ResponsibilitiesSecurity Governance & Policy ManagementDevelop, review, and maintain information security policies, standards, and proceduresAlign governance practices with NIST CSF 2.0, ISO 27001, CIS ControlsSupport development of security control frameworksMaintain audit-ready documentationRisk & Control ManagementConduct enterprise security risk assessmentsDevelop and maintain: IT Risk Taxonomy, IT Risk Register, Control InventorySupport Risk & Control Self-Assessments (RCSA)Identify control gaps and recommend remediation strategiesSecurity Operations & MonitoringSupport and monitor security tools including: SIEM platforms, IDS/IPS systems, Data Loss Prevention (DLP), Endpoint Protection SolutionsAnalyze security events and alertsRecommend detection, tuning, and response improvementsVulnerability & Threat ManagementPerform vulnerability scans and assessmentsAnalyze findings and prioritize remediationSupport threat intelligence and proactive defense initiativesIncident Response & InvestigationDetect, investigate, and respond to cybersecurity incidentsSupport breach analysis and containment activitiesDocument root cause analysis and corrective actionsCompliance & Audit SupportSupport SOC testing and security auditsEnsure alignment with: FISMA, NIST RMF, FedRAMP (as applicable)Prepare compliance artifacts and evidenceSecurity Awareness & AdvisorySupport cybersecurity awareness initiativesPromote best practices across City departmentsRequired Qualifications8–10 years of progressive experience in Information Security / CybersecurityDemonstrated experience in: Security governance, Risk management, Security operations, Incident responseRequired Technical SkillsSIEM technologiesIDS/IPS systemsEndpoint security toolsVulnerability assessment platformsSecurity event analysisRequired Knowledge AreasNIST Cybersecurity Framework (CSF)Risk Management Framework (RMF)Security controls & governanceIncident response methodologiesPreferred QualificationsGovernment / municipal cybersecurity experienceCloud security exposure (AWS / Azure / GovCloud)Experience supporting audits / SOC assessmentsIndustry certifications preferred: CISSP, CISM, CISA, CEHCore CompetenciesStrong analytical and investigative skillsExcellent written and verbal communicationAbility to translate security risks for business stakeholdersHigh attention to documentation and compliance detailAbility to operate independently and collaboratively