IT Security Analyst 3

IT Security Analyst 3 - MiLEAP, MCSC

Location: Lansing, MI

Interview Process:

• 1st round interviews will be held virtually with a potential for a 2nd round in-person.
• Candidates MUST be available for an in-person interview.

Duration:

• 1 year with extension likely.

Work Arrangement:

• Hybrid schedule.
• No remote-only option.
• Must be onsite from Day 1, two days a week.
• Local candidates ONLY.
• Candidates must be located within 90 miles of Lansing, MI at the time of submission.

Top Skills & Years of Experience:

• Experience providing audit evidence to comply with security standards such as NIST, PCI, HIPPA, FERPA - Required - 5 Years.
• Exposure to Complex IT web Applications, within the past 5 years - Required - 5 Years.
• Experience leading meetings and making oral and written reports - Required - 5 Years.
• Experience working as a liaison between different business and IT areas - Required - 5 Years.

Position Description:

• This Senior IT Business/Compliance Analyst position serves as a senior resource providing high-level oversight, guidance, and strategic direction for completing, updating, and maintaining System Security Plans (SSPs) and Disaster Recovery Plans (DRPs) for supported applications.
• The primary duty of this position is performing as the compliance authority and liaison among business partners, technical teams, security groups, and management.
• Ensures that requirements, processes, and documentation align with State standards, NIST protocols, and enterprise security governance.
• Guides stakeholders through complex compliance cycles and drives consistency across application areas.
• Collaborates with vendors, auditors, project managers, and analysts.

Job Responsibilities:

• Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring documentation accuracy, completeness, and alignment with NIST protocol and compliance standards.
• Lead and coordinate the Authority to Operate (ATO) renewal process, including planning, preparing required materials, managing timelines, and ensuring successful approval and continuous compliance for all supported applications.
• Ensure all applications maintain a valid ATO on a three-year cycle and lead efforts to validate and maintain accurate security controls throughout each renewal period.
• Review and inform management on security risk assessment results and recommend corrective actions as necessary.
• Review and assess risks and scope for high-level security incidents. Develop new reports for management based on collected metrics across multiple areas and conduct trend analysis.
• Work with stakeholders to address and track Plans of Action & Milestones (POA&Ms) and other compliance requirements, ensuring timely reporting and closure.
• Provide senior-level support across multiple business areas, with a focus on standardized security plan updates, documentation improvements, and long-term process consistency.
• Analyze existing compliance documentation, identify gaps or risks, and guide corrective actions to meet regulatory and organizational requirements.
• Coordinate cross-functional collaboration with technical teams, business owners, enterprise security personnel, and project leadership to ensure all evidence and artifacts required for SSP and ATO processes are properly completed and maintained.
• Oversee review, updates, and remediation of security controls, ensuring issues are tracked, communicated, and resolved in collaboration with stakeholders.
• Lead efforts to identify procedural gaps, risks, or required updates during renewal cycles, ensuring consistent application of best practices across all supported systems.
• Contribute to enterprise security governance by providing guidance, maintaining accurate records, mentoring team members, and driving timely completion of compliance activities.
• Lead mid- to high-level Incident Responses when working to resolve incidents.
• Serve as the Incident Response Specialist for cyber event detection, correlation, response, and recovery.

Job Qualifications:

• Bachelor's degree in Cybersecurity, Information Assurance, Business Analytics, or IT-related field, OR 5 years of experience.
• Preferred advanced degrees: Master's in Cybersecurity, Information Assurance, Information Systems/IT Leadership, or an MBA with an IT or Security concentration.
• Educational or professional knowledge of NIST Framework and Controls is required.
• Strong aptitude for written and oral communication.
• Strong documentation skills.
• Ability to collaborate cross-functionally.

Required Skills and Experience:

• Experience providing audit evidence to comply with security standards such as NIST, PCI, HIPPA, FERPA - Required - 5 Years.
• Exposure to Complex IT web Applications, within the past 5 years - Required - 5 Years.
• Experience leading meetings and making oral and written reports - Required - 5 Years.
• Experience working as a liaison between different business and IT areas - Required - 5 Years.
• Knowledge or experience creating supporting documentation for IT system audits - Highly Desired - 2 Years.
• Experience with the creation of Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans - Highly Desired - 2 Years.