IT Security Governance Analyst

The Intermediate Security Analyst plays a critical role in monitoring, analyzing, and responding to security events to protect organizational IT assets. This role combines operational security monitoring with governance responsibilities, ensuring compliance with cybersecurity standards and managing third-party cyber risks. The analyst supports audit activities, risk reporting, and the development of IT security governance frameworks to maintain organizational security posture. Responsibilities:

• Perform real-time monitoring and analysis of security events to identify potential incidents.
• Respond to and investigate security alerts and tickets, collecting and analyzing evidence such as network traffic and logs.
• Support the development and maintenance of IT security governance, compliance, audit, and reporting frameworks.
• Ensure adherence to ITSEC policies and compliance with standards including PCI, NIST, ISO 27001, and government regulations.
• Design and report on IT security performance KPIs to stakeholders.
• Collaborate across departments to promote cybersecurity awareness and compliance.
• Contribute to third-party cyber risk management, including risk assessments, contract reviews, and vendor security evaluations.
• Support security audit activities such as PCI, internal, and external audits (e.g., CSAE 3416).
• Manage digital asset inventories ensuring proper classification and risk treatment.
• Assist in developing ITSEC governance training programs for staff and contractors.
• Provide subject matter expertise on industry standards, regulations, and best practices related to IT security governance.

• 4-6 years of progressive experience in IT or related roles with a focus on IT security and cybersecurity.
• 3-5 years of demonstrated competency in cybersecurity risk management.
• Strong understanding of TCP/IP, *nix and Windows systems, network infrastructure, and cyber-attack methodologies.
• Experience with security monitoring, incident response, and evidence analysis.
• Knowledge of cybersecurity standards and frameworks such as PCI, NIST, ISO 27001, and government policies.
• Professional security management certifications preferred, such as CISSP, CISM, CGEIT, CRISC, or CISA.
• Degree in Business, Engineering, Information Systems, Computer Science, or related discipline, or equivalent combination of education and experience.

• Experience in IT project delivery or IT operations.
• Agile certifications such as Agile Certified Professional or Certified Scrum Product Owner.
• Public sector experience.
• Experience conducting vendor risk assessments and managing third-party risk programs.

• Hybrid work environment requiring 3 days in office and 2 days remote.
• May require collaboration with multiple internal and external stakeholders including senior management, audit, finance, and procurement teams.
• Involvement in security audit schedules and vendor security attestations.
• Occasional support for third-party penetration testing activities.

• Standard business hours with potential need for timely incident response and collaboration across teams.
• Work schedule aligned with organizational operational and governance needs.