Security Analyst 3

GRC #GovernanceRiskCompliance #ITSecurity #Cybersecurity #SecurityCompliance #NIST #NISTFramework #ATO #AuthorityToOperate #SSP #SystemSecurityPlan #POAM #AuditCompliance #RiskAssessment Coordinate with technical teams, business owners, enterprise security personnel, and project leadership to ensure required security evidence and documentation are completed and maintained.

Job Title : Senior IT Security Compliance Analyst

Position Overview

Take ownership of enterprise security compliance activities, governance processes, and security documentation across complex IT applications. This senior-level opportunity focuses on System Security Plans (SSPs), Authority to Operate (ATO) renewals, NIST compliance, risk assessments, and incident response coordination.

You will work closely with business stakeholders, technical teams, enterprise security personnel, vendors, auditors, and project leadership to maintain compliance standards, strengthen security governance, and ensure timely completion of security-related activities.

What You'll Do / Key Responsibilities

• Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring documentation accuracy, completeness, and alignment with NIST protocols and compliance standards.

• Lead and coordinate Authority to Operate (ATO) renewal activities, including planning, preparing required materials, managing timelines, and supporting successful approvals.

• Ensure applications maintain valid ATOs on a three-year renewal cycle and validate security controls throughout each renewal period.

• Review security risk assessment results, inform management, and recommend corrective actions.

• Assess security incidents, evaluate risks, and develop management reports using collected metrics and trend analysis across multiple agencies.

• Coordinate with stakeholders to address and track Plans of Action & Milestones (POA&Ms), ensuring timely reporting and closure.

• Analyze existing compliance documentation, identify gaps and risks, and guide corrective actions.

• Coordinate with technical teams, business owners, enterprise security personnel, and project leadership to ensure required security evidence and documentation are completed and maintained.

• Oversee security control reviews, updates, and remediation activities.

• Support enterprise security governance through documentation management, stakeholder guidance, team mentoring, and timely completion of compliance activities.

• Lead mid- to high-level incident response activities.

• Support cyber event detection, correlation, response, and recovery.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Assurance, Business Analytics, or an IT-related field, OR 5 years of experience.

• Educational or professional knowledge of NIST Framework and Controls.

• 3+ years of Governance, Risk, and Compliance (GRC) experience.

• 5 years of experience providing audit evidence to comply with security standards such as NIST, PCI, HIPAA, and FERPA.

• 5 years of exposure to complex IT web applications within the past 5 years.

• 5 years of experience leading meetings and preparing oral and written reports.

• 5 years of experience working as a liaison between different business and IT areas.

• Strong written and oral communication skills.

• Strong documentation skills.

• Ability to collaborate cross-functionally.

Preferred Qualifications

• Master's degree in Cybersecurity, Information Assurance, Information Systems / IT Leadership, or an MBA with an IT or Security concentration.

• 2 years of experience creating supporting documentation for IT system audits.

• 2 years of experience creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans.

• 1–3+ years of Keylight experience.

#GRC #GovernanceRiskCompliance #ITSecurity #Cybersecurity #SecurityCompliance #NIST #NISTFramework #ATO #AuthorityToOperate #SSP #SystemSecurityPlan #POAM #AuditCompliance #RiskAssessment