Senior IT Security Compliance Analyst

The Stafford Gray Group; Town of Lansing (NY); On-site; USD 110,000 - 160,000; Full time

Job summary

The Stafford Gray Group is seeking a Senior IT Security Compliance Analyst to lead security planning and authorization work for a portfolio of public-sector applications. You will be the compliance authority for several business areas, ensuring SSPs, ATOs and security controls align with NIST standards.

In this senior, hands-on role, you will collaborate with business owners, IT teams, auditors and project managers, mentoring junior analysts while driving continuous compliance and risk

Qualifications

• 5+ years providing audit evidence to comply with security standards such as NIST, PCI, HIPAA or FERPA.
• 5+ years exposure to complex IT web applications.
• 5+ years leading meetings and delivering oral and written reports.
• 5+ years working as a liaison between business and IT areas.
• Strong working knowledge of the NIST framework and controls (required).
• Strong writing and documentation skills.
• A bachelor's degree in cybersecurity, information assurance, business analytics or an IT-related field, or 5 years of equivalent experience.

Responsibilities

• Lead the maintenance and updating of System Security Plans (SSPs), making sure they're accurate, complete and aligned with NIST controls.
• Plan and run the ATO renewal process on a three-year cycle, from preparing materials and managing timelines through approval and continuous compliance.
• Validate and maintain security controls throughout each authorization period, and oversee remediation of control gaps.
• Track Plans of Action & Milestones (POA&Ms) and other compliance requirements with stakeholders through to closure.
• Review risk assessment results, brief management, and recommend corrective actions.
• Assess the risk and scope of high-level security incidents, lead mid- to high-level incident response, and support detection, response and recovery.
• Develop metrics-based reports and trend analysis for management across multiple business areas.
• Create and maintain Disaster Recovery Plans, and contribute to business continuity and incident response planning.
• Find gaps in existing compliance documentation and drive consistent practices across all supported systems.
• Coordinate with technical teams, business owners and security staff so that all evidence and artifacts for SSP and ATO work are complete and current.

Skills

NIST knowledge

Audit experience

Stakeholder liaison

Leadership & mentoring

Documentation skills

Written reports

Education

Bachelor's degree in cybersecurity or IT-related field

5 years equivalent experience

Job description

We're looking for a Senior IT Security Compliance Analyst to lead security planning and authorization work for a portfolio of public-sector applications. You'll be the compliance authority for several business areas: keeping System Security Plans current, guiding systems through Authority to Operate (ATO) renewals, and making sure security controls, documentation and processes line up with NIST standards.

This is a senior, hands-on role. You'll work across business owners, technical teams, enterprise security, vendors, auditors and project managers, and you'll mentor other analysts on the team.

What you'll do

• Lead the maintenance and updating of System Security Plans (SSPs), making sure they're accurate, complete and aligned with NIST controls.
• Plan and run the ATO renewal process on a three-year cycle, from preparing materials and managing timelines through approval and continuous compliance.
• Validate and maintain security controls throughout each authorization period, and oversee remediation of control gaps.
• Track Plans of Action & Milestones (POA&Ms) and other compliance requirements with stakeholders through to closure.
• Review risk assessment results, brief management, and recommend corrective actions.
• Assess the risk and scope of high-level security incidents, lead mid- to high-level incident response, and support detection, response and recovery.
• Develop metrics-based reports and trend analysis for management across multiple business areas.
• Create and maintain Disaster Recovery Plans, and contribute to business continuity and incident response planning.
• Find gaps in existing compliance documentation and drive consistent practices across all supported systems.
• Coordinate with technical teams, business owners and security staff so that all evidence and artifacts for SSP and ATO work are complete and current.

Required Qualifications:

• 5+ years providing audit evidence to comply with security standards such as NIST, PCI, HIPAA or FERPA.
• 5+ years of exposure to complex IT web applications.
• 5+ years leading meetings and delivering oral and written reports.
• 5+ years working as a liaison between business and IT areas.
• Strong working knowledge of the NIST framework and controls (required).
• Strong writing and documentation skills.
• A bachelor's degree in cybersecurity, information assurance, business analytics or an IT-related field, or 5 years of equivalent experience.

Preferred Qualifications:

• 2+ years creating documentation to support IT system audits.

• 2+ years creating Disaster Recovery, Business Continuity or Incident Response Plans.
• A master's in cybersecurity, information assurance or IT leadership, or an MBA with an IT or security concentration.
• Certifications such as CISSP, CGRC (formerly CAP), CISA or CISM.