Security and Governance Analyst

Michigan Virtual; Lansing (MI); Hybrid; USD 69,000 - 77,000; Full time

Job summary

Michigan Virtual, a Lansing-based nonprofit, seeks a Security and Governance Analyst to protect systems and data as AI and automation expand. Hybrid work is available, and the role bridges security operations with AI governance, coordinating with the AI, Automation & Governance Manager and MSP.

The ideal candidate has 3+ years in information security, CIS/NIST knowledge, and experience with IAM, privacy, and vendor reviews. A Security+ or similar cert is preferred.

Qualifications

• Hands-on experience in security operations, including monitoring and incident response.
• Familiarity with CIS Controls or NIST security frameworks.
• Experience conducting risk, vendor, or compliance reviews and documenting findings.
• Knowledge of data privacy and FERPA obligations for education tech.
• Understanding of IAM concepts: RBAC, SSO, least privilege.
• Ability to balance security with team needs and communicate risks clearly.

Responsibilities

• Monitor and advise on information security issues affecting internal systems and workflows.
• Review logs (IDS, firewalls, identity, cloud services) for threats and remediation.
• Conduct security assessments and stay current on threats and best practices.
• Support incident response activities and post-incident reviews.
• Collaborate with MSP to triage, escalate, and coordinate response actions.
• Maintain incident records and lessons learned; suggest improvements.
• Provide technical security support to end users.

Skills

Security operations

Security frameworks (CIS/NIST)

Risk, vendor, or compliance reviews

Data privacy (FERPA)

Identity and access management

Clear written and verbal communication

Prioritizing multiple tasks

Education

Bachelor's degree in IT/cybersecurity/CS

Security certification (Security+, CySA+, CCST)

Tools

Microsoft 365

Entra ID

Endpoint management tools

Job description

Position: Security and Governance Analyst

FULL-TIME POSITION

Reports To: AI, Automation, & Governance Manager

Department/Team: Technology Operations

Supervisory Responsibilities: None

FLSA Status: Exempt (Salary)

Location: Hybrid - per Michigan Virtual Policy

Posting Range: $69,246 - $77,393

About the Role

The Security & Governance Analyst works within Technology Operations to maintain Michigan Virtual’s systems and data, ensuring that technology, including AI and automation, is adopted securely, responsibly, and in compliance with organizational standards. Spanning day-to-day security operations and AI governance review, this role serves as the checkpoint between development and approval of AI and automated solutions before release and throughout their lifecycle, working in collaboration with the AI, Automation & Governance Manager, the AI & Automation Specialist, the Managed Service Provider, and teams across the organization to keep security and governance practical and well-documented.

This role suits someone who can hold both sides of security at once: the vigilance to detect and respond to threats, and the judgment to assess risk and document decisions clearly for non-technical audiences.

Put your security skills to work helping Michigan Virtual innovate responsibly and keep our systems and data protected!

About Michigan Virtual

Michigan Virtual is a Lansing-based nonprofit 501(c)(3) organization dedicated to advancing education through research, innovation, policy, and digital learning solutions.

Our mission is to maximize learning and teaching by bringing together the best in people and technology.

Our vision is to be Michigan’s leader in innovation in education.

We serve over 300 full- and part-time employees who are passionate about making a difference for students, educators, and families across Michigan.

Strategic Focus: Our strategic plan guides us through 2030 as we help shape a more flexible and equitable K-12 education system in Michigan. To learn more, visit: https://michiganvirtual.org/about/strategic-plan/

Our Culture

• We believe in a culture of caring. At Michigan Virtual, every team member is welcomed, heard, and valued.
• Our monthly Culture Committee creates opportunities for connection, reviews staff feedback, and champions a positive workplace.
• We emphasize professional growth and continuous learning for all of our employees.
• Our highly collaborative workplace fosters opportunities to use your unique skills, abilities and perspectives in service of our partners and constituents.

Work That Makes a Difference. Culture That Makes It Possible.

As a non-profit organization that receives funding from the State of Michigan, we give preference to residents of Michigan in hiring decisions.

Essential Functions & Responsibilities

Security Monitoring & Analysis

• Monitor and advise on information security issues affecting internal systems and workflows to ensure appropriate security controls are in place.
• Review and analyze logs (IDS, firewalls, identity, and cloud services) to identify threats and vulnerabilities, and implement corrective actions.
• Conduct security assessments of systems, workflows, and applications and stay current on security issues, emerging threats, best practices, and trends.
• Support incident response activities, including investigation, containment, documentation, resolution, and post-incident review.
• Work with the Managed Service Provider (MSP) to identify, triage, and escalate security incidents, including reviewing alerts and monitoring data, determining severity and scope, and coordinating containment and response actions.
• Maintain incident records and lessons learned, and recommend improvements to response procedures.
• Provide technical support for security-related issues from end users.

Vulnerability Management & Compliance

• Perform vulnerability assessments, coordinate corrective actions (patching, removals, updates) with the MSP and IT teams, and track them to completion.
• Support implementation and maintenance of CIS Controls and all other security initiatives.
• Conduct scheduled audits to maintain compliance with security policies, and document findings and remediation.

AI Request Review & Governance Support

• Perform intake triage for AI and automation requests, including risk assessment based on data sensitivity, system access, and impact.
• Conduct security, privacy, and vendor reviews of tools, automations, and other new applications before adoption and periodically afterward, covering data handling, access and permissions, vendor security, and FERPA and data privacy obligations.
• Review AI and automation solutions before production release and verify that access controls and logging are in place.
• Assist with building and maintaining the AI tool and automation inventory and the supporting review records, including purpose, data sources, owners, vendors, risk assessments, and review dates.
• Support the development and maintenance of AI governance policies, standards, and review procedures, and report on compliance, exceptions, and risks.

Other Duties

• Conduct user security training using existing training tools to promote a security-conscious culture.
• Contribute AI security and responsible-use guidance to staff training in partnership with the AI, Automation & Governance team.
• Collaborate closely with the MSP, leadership, and other teams to implement and uphold security practices and standards.
• Clearly communicate security risks, review outcomes, and report compliance status to the Manager and stakeholders.
• Maintain documentation of security systems and procedures, including knowledge base articles for security-related topics.
• Use Wrike to manage tasks, projects, and recurring security and review processes.
• Complete professional development opportunities that strengthen skills and benefit Michigan Virtual.

Qualifications

• Hands-on experience in security operations, such as monitoring, log analysis, vulnerability management, and incident response.
• Working knowledge of security frameworks and controls (such as CIS Controls or NIST).
• Experience conducting risk, vendor, or compliance reviews and documenting findings and decisions.
• Working knowledge of data privacy, FERPA, and responsible use of technology, including the risks of AI tools.
• Familiarity with identity and access management concepts, such as role-based access, single sign-on, and least privilege.
• Experience with Microsoft 365, Entra ID, and endpoint management tools preferred.
• Strong judgment and the ability to balance security and compliance with the needs of the teams being supported.
• Clear written and verbal communication, including the ability to explain security and compliance topics to non-technical audiences.
• Ability to manage competing priorities

Education and Experience

• Bachelor's degree in information technology, cybersecurity, computer science, or a related field, or equivalent experience.
• Three or more years of experience in information security, IT compliance, risk, or a related field.
• Security certification (such as Security+, CySA+, CCST, or similar) required.

Work Environment and Physical Demands

• Open office environment with occasional distractions.
• Noise level is usually low to moderate.
• Extended periods of sitting or standing at a computer.

Michigan Virtual is committed to creating an inclusive and accessible workplace. We welcome applicants of all abilities. We will provide reasonable accommodation for qualified individuals with disabilitiesin the application process and on the job. If you need reasonable accommodation at any point in the application or interview process, please contact us to discuss your needs.