Senior It Security Compliance Analyst

The IT Security Analyst 3 serves as a senior compliance and governance resource within the Department of Technology, Management and Budget (DTMB) Agency Services. This role provides strategic oversight and leadership for maintaining System Security Plans (SSPs), Disaster Recovery Plans (DRPs), and Authority to Operate (ATO) renewals for multiple Michigan state agencies. Acting as a liaison between business units, technical teams, security groups, and management, the analyst ensures alignment with State of Michigan standards, NIST protocols, and enterprise security governance while driving compliance and risk management efforts. Responsibilities:

• Lead maintenance and updating of System Security Plans (SSPs) aligned with NIST and State compliance standards.
• Coordinate and manage the Authority to Operate (ATO) renewal process on a three-year cycle for supported applications.
• Review security risk assessments, recommend corrective actions, and oversee remediation of security controls.
• Analyze and address Plans of Action & Milestones (POA&Ms) and other compliance requirements ensuring timely closure.
• Provide senior-level support across multiple business areas, focusing on standardized security documentation and process consistency.
• Collaborate cross-functionally with technical teams, business owners, security personnel, vendors, auditors, and project managers.
• Develop reports and conduct trend analysis on security incidents and compliance metrics across agencies.
• Lead mid to high-level incident response efforts, including cyber event detection, correlation, response, and recovery.
• Mentor team members and contribute to enterprise security governance initiatives.

• Minimum 3 years of experience in Governance, Risk, and Compliance (GRC), with Keylight experience preferred.
• At least 5 years of experience providing audit evidence for compliance with security standards such as NIST, PCI, HIPAA, and FERPA.
• Five years of exposure to complex IT web applications within the last 5 years.
• Five years of experience leading meetings and preparing oral and written reports.
• Five years of experience acting as a liaison between business and IT areas.
• Bachelor's degree in Cybersecurity, Information Assurance, Business Analytics, IT, or related field, or equivalent work experience.
• Strong knowledge of NIST Framework and Controls.
• Excellent written and oral communication skills and strong documentation abilities.

• Advanced degree such as a Master's in Cybersecurity, Information Assurance, Information Systems, IT Leadership, or an MBA with IT/Security focus.
• Experience creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans (2+ years).
• Knowledge or experience creating supporting documentation for IT system audits (highly desired).

• Candidate must be located within 90 miles of Lansing, Michigan at time of submission.
• Must provide valid Right to Represent documentation and comply with bid submission requirements.
• Resumes must be limited to 4-5 pages; failure to comply may result in rejection.
• Withdrawn candidates cannot be replaced.
• Only one-level deep sub-vendor usage allowed.
• Must be available for both virtual and in-person interviews; in-person attendance is mandatory.
• Candidate must be onsite from day one, working a hybrid schedule with two days onsite per week; no remote-only option.
• Position requires handling sensitive security incidents and incident response duties.

• Full-time position, 40 hours per week.
• Hybrid work schedule: onsite two days per week, remote for remaining days.
• Contract duration: 1 year with likely extension.