Senior Cybersecurity Risk & Compliance Analyst 23-E-48

Illinois Attorney General (IL); Chicago, Springfield (IL, IL); On-site; USD 90,000 - 150,000; Full time

Job summary

The Illinois Attorney General's Office is seeking a Senior Cybersecurity Risk and Compliance Analyst in Chicago to lead security compliance initiatives, assess risks, and implement controls. The role contributes to policy development and audit readiness across the agency.

You will coordinate third‑party risk, prepare compliance reports, and provide guidance on secure data handling, with emphasis on SOC2, NIST CSF, and HIPAA-related standards.

Qualifications

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity or related field.
• Minimum 5 years in cybersecurity compliance, risk assessment, and third‑party risk.
• Certifications such as CISA, CISSP, CISM or CRISC are highly desirable.
• Strong knowledge of SOC 2, NIST CSF, NIST 800-53 and related frameworks.

Responsibilities

• Lead cybersecurity compliance initiatives and manage risk assessments.
• Develop and maintain cybersecurity policies and procedures.
• Coordinate third‑party risk reviews and IT controls assessments.
• Prepare and deliver compliance reports; maintain documentation.
• Provide guidance on secure data handling and training.

Skills

Risk assessment

Third-party risk

Compliance governance

Policy development

Audit readiness

Security awareness

Education

Bachelors in CS/IS/Cybersecurity

Job description

Under the direction of the Chief Information Security Officer (CISO), the Senior Cybersecurity Risk and Compliance Analyst will be responsible for ensuring the organization's adherence to cybersecurity standards, assessing risks, and implementing appropriate controls. The Senior Cybersecurity Risk and Compliance Analyst will be responsible for leading and managing cybersecurity compliance initiatives, developing and maintaining cybersecurity policies and procedures, conducting audits and assessments, coordinating compliance across the organization, performing comprehensive risk assessments, collaborating with stakeholders to develop a risk management framework, managing third-party risk, preparing and delivering compliance reports, maintaining accurate documentation, supporting security awareness initiatives, conducting training sessions, and providing guidance on secure data handling and compliance-related matters. This position requires a bachelor's degree in Computer Science, Information Systems, Cybersecurity or a related field and a minimum of 5 years work experience in cybersecurity compliance, risk assessment, and third-party risk management. Relevant certifications such as CISA, CISSP, CISM, or CRISC are highly desirable. Strong knowledge and experience with SOC2 reviews, NIST CSF, NIST 800-53, and other relevant frameworks are preferred. Familiarity with industry-specific compliance standards such as HIPAA, CJIS and IRS 1075 is a plus. Experience in conducting 3rd-party risk reviews, IT controls assessments, cybersecurity policy compliance reviews, vulnerability assessments and end-user training are expected. Significant knowledge of security technologies, best practices, and emerging trends, as well as strong analytical and problem-solving skills, are essential.

Ability to effectively coordinate, prioritize, and collaborate along with outstanding communication skills to present complex information in a clear and concise manner is required. Attendance and the ability to maintain satisfactory working relationships with OAG employees and the general public is also required.