IT Security Analyst

Job Title: IT Security Analyst II (Compliance & GRC)

Location: Lansing, MI (Hybrid as Required)

Job Type: Contract

Duration: Long-Term

Job Summary

We are seeking an experienced IT Security Analyst II to support enterprise security compliance initiatives by developing, maintaining, and validating System Security Plans (SSPs) and assisting with the Authority to Operate (ATO) process. The ideal candidate will collaborate with project teams, business stakeholders, cybersecurity teams, and technical staff to ensure applications and systems comply with NIST standards, State security policies, and governance requirements.

Key Responsibilities

• Develop, maintain, and update System Security Plans (SSPs) for new and existing enterprise applications.

• Coordinate with Automation Managers, System Owners, Security Administrators, Product Owners, and project teams throughout the Secure SDLC.

• Support Authority to Operate (ATO) activities and security accreditation processes.

• Conduct security risk assessments and document security control implementations.

• Perform security compliance reviews and validate adherence to NIST security controls.

• Coordinate vulnerability assessments, security scans, and remediation activities with cybersecurity teams.

• Monitor Plans of Action & Milestones (POA&M) and corrective action plans.

• Assist with system registration and data classification activities.

• Collect and review security artifacts required for compliance audits and assessments.

• Collaborate with vendors, technical leads, and business stakeholders to satisfy security documentation requirements.

• Identify security gaps and recommend remediation strategies to improve the organization's security posture.

• Ensure compliance with State security policies, standards, and best practices.

• Maintain security documentation within Governance, Risk, and Compliance (GRC) tools.

Required Qualifications

• 1-3 years of experience in Information Security, Cybersecurity, IT Compliance, Risk Management, or Governance.

• Experience creating or maintaining System Security Plans (SSPs).

• Knowledge of NIST Cybersecurity Framework and NIST 800-53 security controls.

• Understanding of Authority to Operate (ATO) processes.

• Experience performing security risk assessments and compliance reviews.

• Knowledge of vulnerability management and security scanning processes.

• Strong analytical, documentation, and problem-solving skills.

• Excellent written and verbal communication skills.

• Ability to collaborate effectively with technical and business teams.

Preferred Skills

• Experience with Governance, Risk & Compliance (GRC) platforms.

• Knowledge of Secure Software Development Lifecycle (Secure SDLC).

• Familiarity with vulnerability scanning tools.

• Experience with enterprise security documentation and audit preparation.

• Understanding of data classification and security governance.

• Experience supporting government or public sector security compliance initiatives.

Education

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Computer Information Systems, Networking, Mathematics, or a related discipline.

• Associate degree in a related technical field with at least two (2) years of relevant IT experience.

• High School Diploma/GED with at least three (3) years of relevant IT experience.

• Relevant IT certifications may be considered in lieu of educational requirements.

Desired Certifications

• Security+

• CISSP (Preferred)

• CISM

• CISA

• CAP

• GSEC

• Certified Cybersecurity (CC)