Senior IT Security Compliance Lead — SSP/ATO & Risk

Stafford Gray; Town of Lansing (NY); On-site; USD 83,000 - 152,000; Full time

Job summary

Stafford Gray in the Lansing area is seeking a Senior IT Security Compliance Analyst to lead a public-sector client’s governance program on a contract basis. You’ll own System Security Plans (SSPs) and Disaster Recovery Plans (DRPs), lead Authority to Operate (ATO) renewals, and act as the go-between for business partners, technical teams, security groups, auditors, and management.

You’ll drive risk assessments, track Plans of Action & Milestones (POA&Ms), mentor staff, and push standardized

Qualifications

• 3+ years of Governance, Risk & Compliance (GRC) experience.
• 5+ years providing audit evidence for security standards such as NIST, PCI, HIPAA, or FERPA.
• Working knowledge of the NIST framework and controls.
• 5+ years exposure to complex IT web applications within the past 5 years.
• 5+ years leading meetings and delivering written and oral reports.
• 5+ years liaising between business and IT.
• Bachelor’s degree in cybersecurity, information assurance, IT, or related field, or 5 years of equivalent experience.

Responsibilities

• Lead maintenance and updating of SSPs to align with NIST controls and compliance standards.
• Plan and run the ATO renewal process on a three-year cycle with materials, timelines, and ongoing validation of controls.
• Track Plans of Action & Milestones (POA&Ms) and other items through reporting and closure.
• Review risk assessment results and advise on corrective actions.
• Assess risk and scope of high-level security incidents and lead incident response.
• Build management reporting and trend analysis from security metrics across business areas.
• Review existing compliance documentation, identify gaps and risks, and guide fixes.
• Coordinate SSP/ATO evidence with technical teams, business owners, vendors, auditors, and leadership.
• Mentor team members and promote standardized compliance processes across systems.

Skills

GRC experience

Audit evidence

NIST controls

Stakeholder liaison

Security reporting

Education

Bachelor's degree in cybersecurity or related field

Tools

Keylight

Archer

ServiceNow GRC

LogicGate

Job description

Stafford Gray in the Lansing area is seeking a Senior IT Security Compliance Analyst to lead a public-sector client’s governance program on a contract basis. You’ll own System Security Plans (SSPs) and Disaster Recovery Plans (DRPs), lead Authority to Operate (ATO) renewals, and act as the go-between for business partners, technical teams, security groups, auditors, and management.

You’ll drive risk assessments, track Plans of Action & Milestones (POA&Ms), mentor staff, and push standardized