BA - Compliance Analyst

Mbi Llc; Harrisburg, Northern (Dauphin County, KY); Hybrid; USD 75,000 - 95,000; Full time

Job summary

Mbi Llc is seeking a Security Awareness and Compliance Analyst to support the Commonwealth's GRC initiatives within the EISO. You will administer the Security Awareness Program, manage phishing simulations, and analyze program effectiveness to drive improvements.

The role includes coordinating training, generating regulatory reports, and contributing to the maturity of the GRC program through continuous improvements and collaboration with agency staff.

Qualifications

• Experience administering security awareness programs.
• Experience planning phishing simulation campaigns.
• Ability to analyze metrics and report findings.
• Strong communication with diverse audiences.
• Familiarity with governance, risk, and compliance concepts.

Responsibilities

• Administers and maintains the enterprise Security Awareness Program.
• Plans, coordinates, and executes phishing simulation campaigns.
• Tracks, analyzes, and reports security awareness metrics using reporting tools.
• Develops and distributes security awareness communications and educational materials.
• Coordinates cybersecurity awareness training activities across the organization.
• Maintains awareness program documentation and records for compliance and audits.
• Assists with regulatory reporting and management reviews.

Skills

Security awareness

Phishing simulations

Regulatory reporting

Data analysis

Communication

Governance, Risk, Compliance

Tools

Phishing simulation platforms

Reporting tools

Compliance tracking systems

Job description

• Under the direction of the IT Compliance and Risk Manager, this position serves as a Security Awareness and Compliance Analyst within the Enterprise Information Security Office (EISO), supporting the Commonwealth's Governance, Risk, and Compliance (GRC) Department.
• The GRC function provides governance, risk evaluation, and compliance oversight to support informed decision-making and the responsible adoption of technology across the Commonwealth.
• The Security Awareness and Compliance Analyst administers the organization's Security Awareness and Phishing Program and supports governance, risk, and compliance initiatives.
• The employee develops and coordinates security awareness activities, manages phishing simulation campaigns, analyzes program effectiveness, and supports regulatory reporting while contributing to the overall maturity of the GRC program.

Description of Major Duties:

• Administers and maintains the enterprise Security Awareness Program.
• Plans, coordinates, and executes phishing simulation campaigns.
• Tracks, analyzes, and reports security awareness and phishing metrics using established reporting tools.
• Develops and distributes security awareness communications and educational materials.
• Coordinates required cybersecurity awareness training activities across the organization.
• Maintains awareness program documentation and records to support compliance and audit requirements.
• Assists with preparation of reports supporting regulatory requirements, audits, and management reviews.
• Recommends improvements to awareness activities based on metrics, emerging threats, and industry best practices.
• Assists with governance, risk, and compliance initiatives as assigned.
• Participates in continuous improvement activities supporting the organization's cybersecurity program.
• Performs related work as assigned.

Knowledge and Abilities

Knowledge of:

• Information security awareness principles
• Cybersecurity fundamentals
• Security awareness and phishing simulation platforms
• Reporting and data analysis techniquesCompliance and audit support activities

Ability to:

• Coordinate multiple projects and training activities
• Analyze program metrics and identify trends
• Communicate effectively with diverse audiences
• Develop user-friendly educational materialsEstablish productive working relationships with agency staff

Fill the skill matrix below:

Skill

Amount

Candidate's No. of years of experience

Plans, coordinates, and executes phishing simulation campaigns.

Required

Administers and maintains the enterprise Security Awareness Program.

Required

Develops and distributes security awareness communications and educational materials.

Required

Maintains awareness program documentation and records to support compliance and audit requirements.

Required

Assists with preparation of reports supporting regulatory requirements, audits, and management reviews.

Required

Recommends improvements to awareness activities based on metrics, emerging threats, and industry best practices.

Required