Senior IT Business / Compliance Analyst - MiLEAP, MCSC

Aroha Technologies, Inc; Lansing (MI); Híbrido; USD 90.000 - 140.000; Jornada completa

Descripción de la vacante

Aroha Technologies, Inc is seeking a Senior IT Business / Compliance Analyst to support DTMB Agency Services for MDCR, MCSC, and MiLEAP. You will oversee SSPs and DRPs, serving as the compliance authority between business and technical teams.

The role emphasizes state standards, NIST guidance, and enterprise security governance. You will guide stakeholders through complex compliance cycles, coordinate with vendors and auditors, and ensure timely completion of compliance activities across

Formación

• Bachelor's degree in Cybersecurity, Information Assurance, Business Analytics, or related IT field is required.
• 5+ years of GRC experience considered; knowledge of NIST required.
• Experience with NIST framework and security controls is mandatory.
• Strong written and verbal communication skills are essential.
• Excellent documentation skills and cross-team collaboration ability.

Responsabilidades

• Provide leadership for maintaining SSPs, aligned with NIST and Michigan standards.
• Lead ATO renewal planning, materials, timelines, and approvals.
• Ensure applications maintain valid ATOs on a three-year cycle.
• Review risk assessment results and recommend corrective actions.
• Develop management reports from security metrics across agencies.
• Coordinate POA&M tracking and closure with stakeholders.
• Guide standardized security plan updates and documentation improvements.
• Identify gaps in compliance and direct corrective actions.
• Ensure evidence for SSP and ATO processes is complete and maintained.
• Oversee remediation of security controls and incident response coordination.
• Mentor team members and promote best security practices.

Conocimientos

GRC

NIST Framework

Security Controls

SSP (System Security Plans)

ATO (Authority to Operate)

DRP (Disaster Recovery Plans)

POA&M

IT Compliance

Risk Assessment

Incident Response

IT Audit Documentation

Keylight

Educación

Bachelor's degree in Cybersecurity / Information Assurance / IT field

Master's degree in Cybersecurity / Information Assurance / Information Systems / IT Leadership

MBA with IT or Security concentration

Herramientas

Keylight

Descripción del empleo

Senior IT Business / Compliance Analyst

Location:

Lansing, Michigan

Work Arrangement:

Hybrid Onsite two days per week from Day 1

Duration:

1 year, with extension likely

Candidate Location:

Local candidates only; must be within 90 miles of Lansing, MI at the time of submission

Interview Process:

First round virtual, with a potential second round in person. Candidates must be available for an in-person interview.

Important Requirements

• Remote-only candidates are not accepted.
• Candidates must be available to work onsite two days per week starting Day 1.
• Candidates must be located within 90 miles of Lansing, Michigan, at the time of submission.
• Newly Added Requirement: 3+ years of Governance, Risk and Compliance (GRC) experience. Keylight experience is preferred.

Job Overview

This Senior IT Business / Compliance Analyst serves as a senior resource supporting the Department of Technology, Management and Budget (DTMB) Agency Services for the Michigan Department of Civil Rights (MDCR), Michigan Civil Service Commission (MCSC), and Michigan Department of Lifelong Education, Advancement and Potential (MiLEAP).

The role provides high-level oversight, guidance, and strategic direction for completing, updating, and maintaining System Security Plans (SSPs) and Disaster Recovery Plans (DRPs) for MCSC and MiLEAP applications.

The primary responsibility is to serve as the compliance authority and liaison between business partners, technical teams, security groups, and management. The analyst ensures requirements, processes, and documentation align with State of Michigan standards, NIST protocols, and enterprise security governance.

The position also guides stakeholders through complex compliance cycles, promotes consistency across application areas, and collaborates with vendors, auditors, project managers, analysts, and teams outside the DTMB Agency Services Compliance Team.

Key Responsibilities

• Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring documentation accuracy, completeness, and alignment with NIST protocols and State of Michigan compliance standards.
• Lead and coordinate the Authority to Operate (ATO) renewal process, including planning, preparing required materials, managing timelines, and securing approvals.
• Ensure all applications maintain valid ATOs on a three-year cycle and validate security controls throughout each renewal period.
• Review security risk assessment results, advise management, and recommend corrective actions.
• Assess risks and scope for high-level security incidents and develop management reports using collected metrics across multiple agencies.
• Conduct trend analysis and provide insights into security incidents and compliance activities.
• Work with stakeholders to address and track Plans of Action and Milestones (POA&Ms), ensuring timely reporting and closure.
• Provide senior-level support across MDCR, MCSC, and MiLEAP, focusing on standardized security plan updates, documentation improvements, and consistent processes.
• Analyze existing compliance documentation, identify gaps or risks, and guide corrective actions to meet regulatory and organizational requirements.
• Coordinate with technical teams, business owners, enterprise security personnel, and project leadership to ensure all evidence and artifacts required for SSP and ATO processes are completed and maintained.
• Oversee the review, updating, and remediation of security controls, ensuring issues are tracked, communicated, and resolved.
• Identify procedural gaps, risks, and required updates during renewal cycles and promote consistent security best practices.
• Support enterprise security governance by providing guidance, maintaining accurate records, mentoring team members, and ensuring timely completion of compliance activities.
• Lead medium- to high-level incident response activities.
• Serve as an incident response specialist for cyber event detection, correlation, response, and recovery.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Assurance, Business Analytics, or a related IT field.
• Alternatively, 5 years of relevant experience may be considered.
• Educational or professional knowledge of the NIST Framework and security controls is mandatory.
• Strong written and verbal communication skills.
• Excellent documentation skills.
• Ability to collaborate effectively across business and technical teams.

Preferred Education

• Master's degree in Cybersecurity, Information Assurance, Information Systems, or IT Leadership.
• MBA with an IT or Security concentration.

Required and Desired Skills Skill / Experience Requirement Experience Governance, Risk and Compliance (GRC) Required 3+ years Providing audit evidence to comply with security standards such as NIST, PCI, HIPAA, and FERPA Required 5 years Exposure to complex IT web applications within the past 5 years Required 5 years Leading meetings and preparing oral and written reports Required 5 years Working as a liaison between different business and IT areas Required 5 years Creating supporting documentation for IT system audits Highly Desired 2 years Creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans Highly Desired 2 years Keylight experience Highly Desired 1 3+ years Primary Skills
Governance, Risk and Compliance (GRC), NIST Framework, Security Controls, System Security Plans (SSP), Authority to Operate (ATO), Disaster Recovery Plans (DRP), POA&M, IT Compliance, Risk Assessment, Incident Response, IT Audit Documentation, Keylight