Information Security Compliance Analyst

Data Recognition Corporation; United States; On-site; USD 80,000 - 110,000; Full time

Benefits offered by this job

Medical insurance

401(k)

Paid time off

Wellness programs

Job summary

Data Recognition Corporation in Minnesota seeks an Information Security Compliance Analyst to lead risk and compliance activities within the information security program. You will drive GovRAMP, RMF, and audit readiness, and partner with teams to ensure secure operations across the enterprise.

This role requires strong communication, integrity, and the ability to translate technical controls into practical policies, with a focus on maintaining SSPs, POAMs, business continuity, and resilience in

Qualifications

• 3+ years in information security, GRC, audit, or compliance.
• Knowledge of NIST 800-53 Rev 5 framework and auditing.
• RMF, STIGs, and POA&M documentation familiarity.
• Experience with SOC 2 Type II audits.

Responsibilities

• Obtain GovRAMP compliance.
• Support ATO approvals for government contracts per RMF.
• Develop and manage SSPs, POAMs, and continuous monitoring.
• Oversee internal/external audits: GovRAMP, ISO 27000, SOC 2 II, customer audits.
• Remediate POAM items and drive remediation.
• Policy and standards development and review.
• Mature security risk management practices.
• Manage Business Continuity/Disaster Recovery processes.
• Update security and compliance metrics.

Skills

GRC experience

Information Security

Audit experience

Communication

Teamwork

Education

Bachelors IT/Cybersecurity

Job description

DRC is one of the largest educational assessment and curriculum/instruction companies in the industry.

Information Security Compliance Analyst

Data Recognition Corporation - Minnesota

Summary

This position is part of the Data Recognition Corporation (DRC) Information Security Team that has an important role in the defining and enabling the secure operation of the DRC environment. This position has responsibility for managing and leading various risk and compliance activities, including internal and external security reviews that are key to validation of our security program.

This position also assists with other aspects of the security practice, including maintaining DRC's security policies, standard and procedures; increasing the organizations security awareness; performing risk assessment and risk management activities; and promoting business continuity and resiliency efforts.

Responsibilities

• Obtain and maintain GovRAMP compliance
• Support Authority to Operate (ATO) approvals for government contracts by adherence to NIST Risk Management Framework (RMF)
• Support cybersecurity efforts to include the development and management of System Security Plan (SSP) documentation, Plans of Action and Milestones (POAMs), assessing and auditing systems security controls, and continuous monitoring activities
• Manage internal and external annual audits (third party and customer)
  • GovRAMP
  • ISO 27000 series
  • SOC II Type 2
  • Various customer audits
• Maintain and drive remediation on Plan of Action and Milestones (POAM) items
• Policy and standard development and review
• Mature security risk management practices
• Manage and enhance Business Continuity/Disaster Recovery processes
• Update and maintain security and compliance metrics

Essential Qualifications

• 3+ years of Information Security, GRC, audit, or compliance experience
• Working knowledge in NIST 800-53 Rev 5 framework and how to implement and audit against the framework
• General knowledge of the following: Risk Management Framework (RMF), compliance with security technical implementation guides (STIGs), and documenting Plan of Action and Milestones (POA&M)
• Experience managing SOC 2 Type II compliance audits
• Possesses a high level of personal integrity and the ability to discreetly handle sensitive, personal, and classified information.
• Must have excellent communication skills and the ability to work well in a team and across the organization, in addition to independently driving initiatives.

Preferred Qualifications

• Four-year college degree in IT, Computer Science, Cybersecurity, or related fields
• Internal or External Audit experience
• Experience with GovRAMP or FedRAMP certifications
• Experience with Federal Information Security Management Act (FISMA) leveraging National Institute of Standards and Technology (NIST) security controls (NIST 800-53, rev 5).
• Security certification such as Certified Information Security Auditor (CISA) and/or Certified in Risk and Information Security Controls (CRISC)
• Experience with ISO 27001 certification
• Experience supporting and participating in third party vendor security assessments and audits, reviewing audit findings as well as responses to security findings and remediation plans.
• Ability to manage cross-functional projects and initiatives as required.

Reporting to this position: No direct reports

The Employer retains the right to change or assign other duties to this position

Company cannot provide sponsorship for this position

Benefits

DRC offers a comprehensive benefits program that allows employees to make choices that best meet their current and future needs. We offer many benefits, including medical, wellness, dental, and vision insurance, a 401(k), flexible spending and health savings accounts, short and long-term disability insurance, and life insurance. DRC also offers a generous paid time off policy and community service leave.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

The salary range is a guideline. Compensation will be based on skills, knowledge, and experience.