Security Analyst

Eightelevengroup; Lansing (MI); Hybrid; USD 128,943,000 - 157,046,000; Full time

Job summary

Eightelevengroup is seeking a Security Analyst to support security compliance and authorization across an enterprise application portfolio in Lansing, MI. The role emphasizes SSP development, review, and advancing ATO activities, translating security requirements into practical, application-specific controls.

The ideal candidate has extensive experience with NIST frameworks, strong technical writing, and a track record mentoring teams while guiding multiple concurrent ATOs.

Qualifications

• 5+ years of professional cybersecurity or information security experience.
• Hands-on experience with NIST security frameworks, controls and requirements.
• Experience developing, reviewing, or maintaining SSPs.
• Experience supporting ATO processes.
• Experience developing and managing POA&Ms.
• Strong understanding of cybersecurity controls for apps/environments.
• Ability to translate requirements into practical app-specific needs.
• Strong technical writing and documentation skills.
• Excellent communication with technical and business stakeholders.
• Ability to work independently on multiple applications.
• Experience mentoring security professionals.

Responsibilities

• Lead and support SSP development, review, and completion.
• Collaborate with owners to ensure SSPs cover security requirements.
• Support applications through the ATO process and cadence.
• Translate NIST requirements into practical, application-specific needs.
• Review SSP docs to identify gaps and remediation needs.
• Develop and maintain security documentation for authorization.
• Explain security requirements to customers and teams.
• Learn the application environment and act as SME for NIST/SSP/ATO.
• Mentor other security professionals and teams.
• Identify opportunities to improve SSP/ATO processes.

Skills

Cybersecurity experience

NIST frameworks

SSP development

ATO processes

POA&M management

Security controls

Requirements translation

Technical writing

Communication skills

Independent work

Mentoring

Education

Master's degree in Cybersecurity or related field

Tools

Keylight

Job description

Security Analyst

Public Sector Client

Location: Lansing, MI - Hybrid on site Monday and Tuesday

Rate: $45-$55/hr.

Position Overview

We are seeking an experienced Security Analyst to support security compliance and authorization activities across an enterprise application portfolio. This individual will focus on developing, reviewing, and advancing System Security Plans (SSPs) and Authority to Operate (ATO) activities while helping application teams navigate security requirements and processes.

The ideal candidate will have strong experience working within NIST security frameworks and controls, with a proven ability to translate security requirements into practical requirements for specific applications and environments.

This position will serve as a subject matter expert and mentor across the application portfolio, working directly with customers, application teams, and security stakeholders to bring applications through the appropriate security and authorization cadence.

Key Responsibilities

• Lead and support the development, review, and completion of System Security Plans (SSPs) across the application portfolio.
• Work with application owners and customers to ensure SSPs comprehensively address applicable security requirements.
• Support applications through the Authority to Operate (ATO) process and help establish or restore appropriate authorization cadence.
• Translate NIST requirements and security controls into practical, application-specific requirements and recommendations.
• Review SSP documentation in detail to identify gaps, inconsistencies, and areas requiring additional evidence or remediation.
• Develop and maintain security documentation necessary to advance applications through the authorization process.
• Work directly with customers and application teams to explain security requirements and assist them in addressing deficiencies.
• Learn the organization's application environment and security processes and become a trusted SME for NIST, SSP, and ATO activities.
• Provide mentorship and guidance to other security professionals and application teams across the portfolio.
• Identify opportunities to improve consistency, efficiency, and repeatability within the SSP and ATO processes.

Required Qualifications

• 5+ years of professional cybersecurity or information security experience.
• Multiple years of hands-on experience working with NIST security frameworks, controls, and requirements.
• Demonstrated experience developing, reviewing, or maintaining System Security Plans (SSPs).
• Experience supporting Authority to Operate (ATO) processes.
• Experience developing and managing Plans of Action and Milestones (POA&Ms).
• Strong understanding of cybersecurity controls and how they apply to applications and enterprise environments.
• Ability to interpret security requirements and translate them into practical, application-specific requirements.
• Strong technical writing and documentation skills.
• Excellent communication skills with the ability to work directly with both technical teams and business/customer stakeholders.
• Ability to work independently while managing multiple applications and security activities simultaneously.
• Demonstrated ability to mentor and provide guidance to other security professionals.

Preferred Qualifications

• Master's degree in Cybersecurity, Information Security, Computer Science, or a related field.
• Experience working within a State Government or public-sector cybersecurity environment.
• Experience with Keylight or similar GRC/security authorization platforms.
• Experience working with NIST SP 800-53 or related NIST publications.
• Experience supporting enterprise application portfolios with numerous concurrent ATOs.
• Experience working with security control assessments, evidence collection, risk assessments, and remediation activities.
• Relevant cybersecurity certifications such as CISSP, CISM, CRISC, Security+, or equivalent.