Stafford Gray is looking for a Senior IT Security Compliance Analyst for a contract role with a public-sector client in the Lansing area. You’ll be the senior compliance lead for a portfolio of agency applications. You’ll own System Security Plans and Disaster Recovery Plans, lead Authority to Operate (ATO) renewals, and act as the go-between for business partners, technical teams, security groups, auditors, and management.
What you’ll do
- Lead the maintenance and updating of System Security Plans (SSPs) so they’re accurate, complete, and aligned with NIST controls and the organization’s compliance standards.
- Plan and run the ATO renewal process on a three-year cycle. That means preparing materials, managing timelines, and making sure security controls stay validated between renewals.
- Work with stakeholders to track Plans of Action & Milestones (POA&Ms) and other compliance items through to reporting and closure.
- Review security risk assessment results, brief management, and recommend corrective actions.
- Assess the risk and scope of high-level security incidents. Lead mid- to high-level incident response, from detection and correlation through response and recovery.
- Build management reporting and trend analysis from security metrics across multiple business areas.
- Review existing compliance documentation, find gaps and risks, and guide the fixes.
- Coordinate with technical teams, business owners, enterprise security, vendors, auditors, and project leadership so that SSP and ATO evidence and artifacts are complete and current.
- Mentor team members and push for consistent, standardized compliance processes across all supported systems.
Requirements
Required
- 3+ years of Governance, Risk & Compliance (GRC) experience.
- 5+ years providing audit evidence for security standards such as NIST, PCI, HIPAA, or FERPA.
- Working knowledge of the NIST framework and controls.
- 5+ years of exposure to complex IT web applications, within the past 5 years.
- 5+ years leading meetings and delivering written and oral reports.
- 5+ years working as a liaison between business and IT areas.
- A bachelor’s degree in cybersecurity, information assurance, IT, or a related field, or 5 years of equivalent experience.
- Strong documentation and communication skills.
Highly desired
- 2+ years creating supporting documentation for IT system audits.
- 2+ years creating Disaster Recovery, Business Continuity, and Incident Response plans.
- Experience with Keylight or a comparable GRC platform, such as Archer, ServiceNow GRC, or LogicGate.
- An advanced degree in cybersecurity, information assurance, or IT leadership, or an MBA with an IT or security concentration.
- Security certifications such as CISSP, CISM, CISA, or CRISC.