Information Security Analyst

Information Security Analyst

We are seeking an experienced Information Security Analyst to support and strengthen the City's cybersecurity, risk management, and compliance programs. This role will serve as a key contributor in developing security governance frameworks, conducting risk assessments, supporting security operations, and ensuring regulatory and standards alignment. The ideal candidate will bring deep expertise in cybersecurity analysis, risk management, incident response, and security technologies, along with the ability to collaborate across technical and non-technical stakeholders.

Key Responsibilities:

• Security Governance & Policy Management
• Develop, review, and maintain information security policies, standards, and procedures
• Align governance practices with NIST CSF 2.0, ISO 27001, CIS Controls
• Support development of security control frameworks
• Maintain audit-ready documentation

• Risk & Control Management
• Conduct enterprise security risk assessments
• Develop and maintain: IT Risk Taxonomy, IT Risk Register, Control Inventory
• Support Risk & Control Self-Assessments (RCSA)
• Identify control gaps and recommend remediation strategies

• Security Operations & Monitoring
• Support and monitor security tools including: SIEM platforms, IDS/IPS systems, Data Loss Prevention (DLP), Endpoint Protection Solutions
• Analyze security events and alerts
• Recommend detection, tuning, and response improvements

• Vulnerability & Threat Management
• Perform vulnerability scans and assessments
• Analyze findings and prioritize remediation
• Support threat intelligence and proactive defense initiatives

• Incident Response & Investigation
• Detect, investigate, and respond to cybersecurity incidents
• Support breach analysis and containment activities
• Document root cause analysis and corrective actions

• Compliance & Audit Support
• Support SOC testing and security audits
• Ensure alignment with: FISMA, NIST RMF, FedRAMP (as applicable)
• Prepare compliance artifacts and evidence

• Security Awareness & Advisory
• Support cybersecurity awareness initiatives
• Promote best practices across City departments

Required Qualifications:

• 8–10 years of progressive experience in Information Security / Cybersecurity
• Demonstrated experience in: security governance, risk management, security operations, incident response

Required Technical Skills:

• SIEM technologies
• IDS/IPS systems
• Endpoint security tools
• Vulnerability assessment platforms
• Security event analysis

Required Knowledge Areas:

• NIST Cybersecurity Framework (CSF)
• Risk Management Framework (RMF)
• Security controls & governance
• Incident response methodologies

Preferred Qualifications:

• Government / municipal cybersecurity experience
• Cloud security exposure (AWS / Azure / GovCloud)
• Experience supporting audits / SOC assessments
• Industry certifications preferred: CISSP, CISM, CISA, CEH

Core Competencies:

• Strong analytical and investigative skills
• Excellent written and verbal communication
• Ability to translate security risks for business stakeholders
• High attention to documentation and compliance detail
• Ability to operate independently and collaboratively