Compliance Business Analyst

Job ID: MI-142336

Hybrid/Local Govt Compliance BA (15+) with DR, BC, NIST/PCI/HIPPA/FERPA, GRC, SSP, POAM, RA, ATO and Education experience

Location: Lansing, MI (DTMB)
Duration: 12 Months
Position: 1

Local or non-local: Local candidates (strongly preferred) or non-local (must be willing to relocate at their own expense from acceptance with no delays & follow the hybrid schedule)

Skills:
. Exposure to Complex IT web Applications, within the past 5 years 5+ years
. Experience in a role, as a business analyst, supporting a software development project, in the past 5 years 5+ years
. Experience leading meetings and making oral and written reports and presentations on work assignments 5+ years
. Experience with MS Office to create project documentation 5+ years
. Experience working as a liaison between different business and IT areas 5+ years
. Knowledge and understanding of the Software Development Lifecycle
. Knowledge or experience creating supporting documentation for IT system audits
. Experience with the creation of Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans
. Experience providing audit evidence to comply with security standards such as NIST, PCI, HIPPA, FERPA

Job Description:
The IT Compliance Business Analyst with the Department of Technology, Management, and Budget
(DTMB) Agency Services supporting the Michigan Department of Education (MDE) will coordinate
agency, DTMB, and vendor efforts to adhere to the State of Michigan (SOM) Governance, Risk, and
Compliance (GRC) practices and policies. This position will be responsible for leading project teams
through the Michigan Security Accreditation Process (MiSAP) to assist in the effort of supporting the
Michigan Department of Education. MiSAP sets security requirements for software, applications,
systems, or other technical products that need to connect with the State of Michigan IT infrastructure or
be consumed by agencies within the State of Michigan. The Michigan Security Accreditation Process
consists of several stages that include data classification, system security plan (SSP), risk assessment
(RA), control task, and plan of action and milestones (POAM). The goal of the process is to achieve
authority to operate (ATO) once all stages have been successfully completed. Project documentation as
well as application vulnerability scanning onboarding and requests, are also artifacts that are facilitated
by or created by the resource within this position.
The expectation is that the person filling this position would also assist with completing disaster
recovery plans, incident response plans, and business continuity plans. This position will also be required
to provide training and interpretation of the frameworks, regulations, laws, policies and GRC tools the
State of Michigan must adhere to. This position will assist with compliance of audit criteria and provide
process development and audit support for partner agencies IT systems, web sites, web applications,
mobile sites, and mobile applications.
The IT Compliance Business Analyst with the Department of Technology, Management, and Budget
(DTMB) Agency Services supporting the Michigan Department of Education (MDE) will coordinate
agency, DTMB, and vendor efforts to adhere to the State of Michigan (SOM) Governance, Risk, and
Compliance (GRC) practices and policies. This position will be responsible for leading project teams
through the Michigan Security Accreditation Process (MiSAP) to assist in the effort of supporting the
Michigan Department of Education. MiSAP sets security requirements for software, applications,
systems, or other technical products that need to connect with the State of Michigan IT infrastructure or
be consumed by agencies within the State of Michigan. The Michigan Security Accreditation Process
consists of several stages that include data classification, system security plan (SSP), risk assessment
(RA), control task, and plan of action and milestones (POAM). The goal of the process is to achieve
authority to operate (ATO) once all stages have been successfully completed. Project documentation as
well as application vulnerability scanning onboarding and requests, are also artifacts that are facilitated
by or created by the resource within this position.
The expectation is that the person filling this position would also assist with completing disaster
recovery plans, incident response plans, and business continuity plans. This position will also be required
to provide training and interpretation of the frameworks, regulations, laws, policies and GRC tool the
State of Michigan must adhere to. This position will assist with compliance of audit criteria and provide
process development and audit support for partner agencies IT systems, web sites, web applications,
mobile sites, and mobile applications.