Senior IT Security Compliance Analyst

Stafford Gray; Lansing (MI); On-site; USD 95,000 - 130,000; Full time

Job summary

Stafford Gray is seeking a Senior IT Security Compliance Analyst for a contract role with a public-sector client in the Lansing area. You’ll lead the compliance program for agency applications, owning SSPs and ATO renewals, and coordinating with auditors and technical teams.

You’ll mentor staff, drive standardized processes, and report on security metrics while partnering with business and IT stakeholders to close gaps.

Qualifications

• 3+ years in Governance, Risk & Compliance (GRC).
• 5+ years providing audit evidence for NIST, PCI, HIPAA, or FERPA.
• Knowledge of the NIST framework and controls.
• 5+ years exposure to complex IT web applications.
• 5+ years leading meetings and delivering reports.
• 5+ years liaising between business and IT areas.
• Bachelor’s degree in cybersecurity, information assurance, IT, or related field, or 5 years equivalent.
• Strong documentation and communication skills.

Responsibilities

• Lead the maintenance and updating of SSPs so they’re accurate and aligned with NIST controls.
• Plan and run the ATO renewal process on a three-year cycle with timely materials.
• Track POA&Ms and compliance items through reporting and closure.
• Review security risk results, brief management, and recommend actions.
• Assess risk of incidents and lead mid- to high-level incident response.
• Build reporting and trend analysis from security metrics across areas.
• Review compliance docs, identify gaps and guide fixes.
• Coordinate SSP/ATO evidence with teams, owners, vendors, auditors, and leadership.
• Mentor team members and push for standardized compliance processes.

Skills

GRC experience

Stakeholder liaison

Auditing

Policy documentation

NIST controls

Education

Bachelor's degree in cybersecurity, information assurance, IT, or related field

Job description

Stafford Gray is looking for a Senior IT Security Compliance Analyst for a contract role with a public-sector client in the Lansing area. You’ll be the senior compliance lead for a portfolio of agency applications. You’ll own System Security Plans and Disaster Recovery Plans, lead Authority to Operate (ATO) renewals, and act as the go-between for business partners, technical teams, security groups, auditors, and management.

What you’ll do

• Lead the maintenance and updating of System Security Plans (SSPs) so they’re accurate, complete, and aligned with NIST controls and the organization’s compliance standards.
• Plan and run the ATO renewal process on a three-year cycle. That means preparing materials, managing timelines, and making sure security controls stay validated between renewals.
• Work with stakeholders to track Plans of Action & Milestones (POA&Ms) and other compliance items through to reporting and closure.
• Review security risk assessment results, brief management, and recommend corrective actions.
• Assess the risk and scope of high-level security incidents. Lead mid- to high-level incident response, from detection and correlation through response and recovery.
• Build management reporting and trend analysis from security metrics across multiple business areas.
• Review existing compliance documentation, find gaps and risks, and guide the fixes.
• Coordinate with technical teams, business owners, enterprise security, vendors, auditors, and project leadership so that SSP and ATO evidence and artifacts are complete and current.
• Mentor team members and push for consistent, standardized compliance processes across all supported systems.

Required

• 3+ years of Governance, Risk & Compliance (GRC) experience.
• 5+ years providing audit evidence for security standards such as NIST, PCI, HIPAA, or FERPA.
• Working knowledge of the NIST framework and controls.
• 5+ years of exposure to complex IT web applications, within the past 5 years.
• 5+ years leading meetings and delivering written and oral reports.
• 5+ years working as a liaison between business and IT areas.
• A bachelor’s degree in cybersecurity, information assurance, IT, or a related field, or 5 years of equivalent experience.
• Strong documentation and communication skills.

Highly desired

• 2+ years creating supporting documentation for IT system audits.
• 2+ years creating Disaster Recovery, Business Continuity, and Incident Response plans.
• Experience with Keylight or a comparable GRC platform, such as Archer, ServiceNow GRC, or LogicGate.
• An advanced degree in cybersecurity, information assurance, or IT leadership, or an MBA with an IT or security concentration.
• Security certifications such as CISSP, CISM, CISA, or CRISC.