IT & Security Governance Analyst

Communication Service for the Deaf (CSD); Austin (TX); On-site; USD 85,000 - 120,000; Full time

Job summary

Communication Service for the Deaf (CSD) in Austin, TX seeks an IT & Security Governance Analyst to strengthen governance processes across corporate IT, cloud, and product environments, focusing on security controls, data stewardship, and risk tracking.

You will help operationalize compliance frameworks, build risk registers, and collaborate with engineering and program teams to ensure resilient, auditable systems and practical security practices across the organization.

Qualifications

• Bachelor's degree or equivalent and 1 year of IT governance or risk experience.
• Experience across IT or security domains.
• Knowledge of IAM concepts like SSO and MFA.
• Familiarity with security frameworks (e.g., PCI DSS, SOC 2, ISO 27001).

Responsibilities

• Support IT governance, risk, and reporting initiatives across corporate IT, cloud, and product environments.
• Maintain technology risk register and remediation tracking.
• Assist with IT and security policies, standards, and procedures.
• Coordinate with Engineering and program teams to ensure secure systems and data flows.
• Prepare governance metrics and audit readiness documentation.

Skills

IAM principles

Risk analysis

Cross-functional collaboration

Security governance

Audit readiness

Education

Bachelor's degree in IT, Cybersecurity, CS or related

Tools

SIEM

MDM

EDR

Vulnerability scanners

Job description

Description

The IT & Security Governance Analyst supports technology governance, security, and operational maturity initiatives across corporate IT, cloud and product environments, and operational systems. This role works across the organization to strengthen governance processes, maintain security controls and documentation, support data stewardship, and identify and track technology risks.

This position helps operationalize compliance frameworks as practical tools to improve efficiency, accountability, risk management, and resilience, rather than treating compliance as the sole objective.

IT Governance, Risk & Reporting

• Support the development and maintenance of the organization's IT and security roadmap aligned with mission priorities and partner obligations.
• Maintain the technology risk register, including security, data, vendor, and operational risks, and track remediation activities.
• Assist with developing, documenting, and maintaining IT and security policies, standards, and procedures.
• Maintain system ownership documentation, governance records, and technology inventories.
• Prepare technology governance metrics, risk reports, and audit readiness documentation.

Data Governance & System Oversight

• Support implementation and maintenance of data classification, access governance, and retention standards.
• Document and maintain key data flows across internal systems, partner integrations, and cloud environments.
• Review encryption, logging, and access controls for alignment with data sensitivity and contractual requirements.
• Partner with Engineering and program teams to support secure and scalable system practices.
• Maintain architecture documentation, data flow diagrams, and security control mappings.

Identity, Access & Organizational IT Foundations

• Support identity and access management processes, including SSO, MFA, least privilege, access reviews, and joiner-mover-leaver workflows.
• Coordinate endpoint and device management practices, including MDM, encryption, patching, configuration baselines, and endpoint protection.
• Review SaaS governance practices and recommend improvements to reduce shadow IT risk.
• Support validation of backup, recovery, and resilience capabilities for critical systems.
• Provide guidance to departments on security and data handling best practices.

Cloud, Application & Vulnerability Management

• Partner with Engineering to support Secure SDLC practices.
• Coordinate vulnerability management activities, including scanning, triage, remediation tracking, and verification.
• Support cloud security practices related to IAM, key management, logging, monitoring, and network security.
• Participate in security and architecture reviews for new systems and major technology initiatives.

Incident Response, Vendor Risk & Partner Assurance

• Maintain incident response documentation, runbooks, and severity classifications.
• Support tabletop exercises and track remediation activities.
• Assist with business continuity and disaster recovery testing.
• Coordinate vendor and partner security assessments and remediation tracking.
• Support audits, customer security questionnaires, and partner assurance initiatives.
• Partner with Legal and business stakeholders to support implementation of data protection and security requirements.
• Other duties as assigned.

Requirements

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or a minimum of one (1) year of relevant experience in IT governance, cybersecurity, IT operations, or risk management.
• Experience working across multiple IT or security domains.
• Understanding of IAM principles, including SSO, MFA, least privilege, and access reviews.
• Working knowledge of areas such as logging, endpoint security, encryption, backup management, vulnerability management, and network security.
• Experience supporting IT, data, or security governance initiatives.
• Ability to analyze technical risks and develop practical recommendations.
• Ability to coordinate cross-functional initiatives and work effectively with technical and non-technical stakeholders.
• Experience supporting audits or security frameworks such as PCI DSS, SOC 2, ISO 27001, NIST 800-53 Rev. 5, or HIPAA-adjacent controls preferred.
• Experience with AWS, Azure, or GCP and CI/CD environments preferred.
• Experience with MDM, EDR, SIEM, vulnerability scanners, or related tooling preferred.
• Familiarity with secure software development practices and threat modeling preferred.
• Relevant certifications such as Security+, SSCP, GSEC, or equivalent preferred.
• Experience supporting grant-funded initiatives, multi-partner collaborations, or externally funded programs preferred.
• Ability to communicate effectively in American Sign Language preferred.