Find JobsSalary EstimateCareer AdviceUpload ResumeEmployers / Post JobProfileMessage Center

Technical Security Risk & Governance Analyst

Crystal Data LLC

Harrisburg, PA

Apply
JOB DETAILS
JOB TYPE
Temporary, Contractor, Full-time
SKILLS
Amazon Web Services (AWS), Analysis Skills, Auditing, CCSP - Cisco Certified Security Professional, CISA - Certified Information Systems Auditor, CISM - Certified Information Security Manager, CISSP - Certified Information Systems Security Professional, Change Requests/Orders, Cloud Computing, CompTIA Security+, Computer Science, Computer Security, Corrective Action, Cryptography, Data Analysis, DevOps, Documentation, Endpoint Security, External Audit, Family Educational Rights and Privacy Act (FERPA), GCP (Good Clinical Practices), HIPAA (Health Insurance Portability and Accountability Act), ISO (International Organization for Standardization), Identity Data Management, Incident Response, Information Technology & Information Systems, Information/Data Security (InfoSec), Infrastructure as a Service (IaaS), Internal Audit, International Electro-Technical Commission (IEC), Internet Security, Leadership, Legal, Machine Tool, Maintain Compliance, Metrics, Microsoft Windows Azure, Negotiation Skills, Network Security, PCI-DSS, Platform as a Service (PaaS), Power BI, Public Key Infrastructure (PKI), Purchasing/Procurement, Regulations, Regulatory Reports, Reporting Dashboards, Reporting Skills, Risk, Risk Analysis, Risk Management, Security Analysis, Security Architecture, Security Information and Event Management (SIEM), Service Level Agreement (SLA), Software Patches, Software as a Service (SaaS), State Laws and Regulations, Technical Analysis, Testing, Threat Modeling, Treatment Plan, U.S. National Institute of Standards and Technology (NIST)
LOCATION
Harrisburg, PA
POSTED
2 days ago

 

Technical Security Risk & Governance Analyst

Harrisburg, PA

Hybrid schedule - 2 days on-site per week in Harrisburg



Position Summary

The Technical Security Risk & Governance Analyst supports the state’s cybersecurity program by performing risk assessments, control testing, and governance activities across enterprise systems, applications, networks, and cloud services. This role partners with IT, business owners, and audit teams to ensure security controls are designed, implemented, and operating effectively in alignment with state policy, NIST CSF/800-53, and other regulatory frameworks (e.g., CJIS, IRS Pub 1075, HIPAA, PCI DSS). The Analyst develops pragmatic recommendations, tracks remediation,and produces metrics for leadership and regulatory reporting.

Key Responsibilities

Risk Assessment & Control Assurance

  • Conduct technical security risk assessments for on‑prem, cloud (IaaS/PaaS/SaaS), and hybrid solutions; document risks, likelihood/impact, and recommended mitigations.
  • Perform control design/operating‑effectiveness testing against NIST CSF/800‑53, CIS Controls, ISO/IEC 27001, and agency security standards.
  • Support Authority to Operate (ATO) processes, security attestations, and continuous monitoring.
  • Facilitate threat modeling and security architecture reviews; advise on secure patterns (network segmentation, IAM, least privilege, encryption, logging).

Governance& Compliance

  • Maintain security policies, standards, procedures, and control libraries; align updates with legislative or regulatory changes.
  • Map agency controls to relevant mandates (e.g., CJIS, IRS 1075, HIPAA, FERPA, PCI DSS, state statutes/policies) and track compliance gaps.
  • Coordinate internal/external audits; lead evidence collection, responses, and remediation plans.
  • Administer or contribute to GRC tooling for issues, exceptions, and risk registers.

Vulnerability& Third‑Party Risk

  • Establish governance for vulnerability management (SLAs, exception management, risk acceptance); monitor patching and remediation progress.
  • Perform vendor/security reviews (SaaS, MSPs, cloud providers), evaluate SOC 2/ISO certifications, and negotiate security clauses with procurement/legal.
  • Review data protection, encryption, and privacy risks in new procurements and major system changes.

Metrics, Reporting & Communication

  • Develop and maintain dashboards and performance indicators (risk posture, control maturity, vulnerability closure rates); brief leadership on trends and priorities.
  • Produce clear, actionable reports for technical teams and non‑technical stakeholders.
  • Promote security awareness and targeted training(e.g., secure configuration, privacy by design, third‑party onboarding).

Incident& Change Advisory Support

  • Provide risk-informed guidance during incident response (root cause, control gaps, corrective actions).
  • Review change requests for security impacts; ensure appropriate testing, logging, and rollback plans.

Required Qualifications

  • Bachelor’s degree in Information Security, Computer Science, Information Systems, or related field; OR equivalent experience.
  • 1–3 years in information security, risk management, audit, or related technical role.

Preferred Qualifications(not required)

  • CISSP, CISM, CRISC, CGRC (CAP), Security+, CCSK/CCSP, CISA
  • Vendor/cloud certs (AWS/Azure/GCP security specialty) are a plus.

Knowledge

  • Security frameworks and regulations: NIST CSF/800‑53, CIS Controls, ISO 27001; familiarity with CJIS, IRS Pub 1075, HIPAA, FERPA, PCI DSS, and state policy.
  • Core security domains: identity and access management (IAM), network security, endpoint security, vulnerability management, logging/SIEM, encryption/PKI, secure DevOps.
  • Cloud security concepts (shared responsibility, CSPM, workload protection, KMS/CMKs, conditional access, zero trust).

Skills

  • Technical assessment and control testing;ability to validate configurations and interpret scan results
  • Risk analysis and documentation; creating practical risk treatment plans and exceptions with compensating controls.
  • Using GRC platforms; building workflows, control libraries, and risk registers.
  • Data analysis and dashboarding (Excel/Power BI),concise report writing, and presentation to executives.

 

About the Company

C

Crystal Data LLC

INDUSTRY
Computer/IT Services