Senior IT Business / Compliance Analyst
Location: Lansing, Michigan
Work Arrangement: Hybrid Onsite two days per week from Day 1
Duration: 1 year, with extension likely
Candidate Location: Local candidates only; must be within 90 miles of Lansing, MI at the time of submission
Interview Process: First round virtual, with a potential second round in person. Candidates must be available for an in-person interview.
Important Requirements
-
Remote-only candidates are not accepted.
-
Candidates must be available to work onsite two days per week starting Day 1.
-
Candidates must be located within 90 miles of Lansing, Michigan, at the time of submission.
-
Newly Added Requirement: 3+ years of Governance, Risk and Compliance (GRC) experience. Keylight experience is preferred.
Job Overview
This Senior IT Business / Compliance Analyst serves as a senior resource supporting the Department of Technology, Management and Budget (DTMB) Agency Services for the Michigan Department of Civil Rights (MDCR), Michigan Civil Service Commission (MCSC), and Michigan Department of Lifelong Education, Advancement and Potential (MiLEAP).
The role provides high-level oversight, guidance, and strategic direction for completing, updating, and maintaining System Security Plans (SSPs) and Disaster Recovery Plans (DRPs) for MCSC and MiLEAP applications.
The primary responsibility is to serve as the compliance authority and liaison between business partners, technical teams, security groups, and management. The analyst ensures requirements, processes, and documentation align with State of Michigan standards, NIST protocols, and enterprise security governance.
The position also guides stakeholders through complex compliance cycles, promotes consistency across application areas, and collaborates with vendors, auditors, project managers, analysts, and teams outside the DTMB Agency Services Compliance Team.
Key Responsibilities
-
Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring documentation accuracy, completeness, and alignment with NIST protocols and State of Michigan compliance standards.
-
Lead and coordinate the Authority to Operate (ATO) renewal process, including planning, preparing required materials, managing timelines, and securing approvals.
-
Ensure all applications maintain valid ATOs on a three-year cycle and validate security controls throughout each renewal period.
-
Review security risk assessment results, advise management, and recommend corrective actions.
-
Assess risks and scope for high-level security incidents and develop management reports using collected metrics across multiple agencies.
-
Conduct trend analysis and provide insights into security incidents and compliance activities.
-
Work with stakeholders to address and track Plans of Action and Milestones (POA&Ms), ensuring timely reporting and closure.
-
Provide senior-level support across MDCR, MCSC, and MiLEAP, focusing on standardized security plan updates, documentation improvements, and consistent processes.
-
Analyze existing compliance documentation, identify gaps or risks, and guide corrective actions to meet regulatory and organizational requirements.
-
Coordinate with technical teams, business owners, enterprise security personnel, and project leadership to ensure all evidence and artifacts required for SSP and ATO processes are completed and maintained.
-
Oversee the review, updating, and remediation of security controls, ensuring issues are tracked, communicated, and resolved.
-
Identify procedural gaps, risks, and required updates during renewal cycles and promote consistent security best practices.
-
Support enterprise security governance by providing guidance, maintaining accurate records, mentoring team members, and ensuring timely completion of compliance activities.
-
Lead medium- to high-level incident response activities.
-
Serve as an incident response specialist for cyber event detection, correlation, response, and recovery.
Required Qualifications
-
Bachelor's degree in Cybersecurity, Information Assurance, Business Analytics, or a related IT field.
-
Alternatively, 5 years of relevant experience may be considered.
-
Educational or professional knowledge of the NIST Framework and security controls is mandatory.
-
Strong written and verbal communication skills.
-
Excellent documentation skills.
-
Ability to collaborate effectively across business and technical teams.
Preferred Education
-
Master's degree in Cybersecurity, Information Assurance, Information Systems, or IT Leadership.
-
MBA with an IT or Security concentration.
Required and Desired Skills
| Skill / Experience | Requirement | Experience |
| Governance, Risk and Compliance (GRC) | Required | 3+ years |
| Providing audit evidence to comply with security standards such as NIST, PCI, HIPAA, and FERPA | Required | 5 years |
| Exposure to complex IT web applications within the past 5 years | Required | 5 years |
| Leading meetings and preparing oral and written reports | Required | 5 years |
| Working as a liaison between different business and IT areas | Required | 5 years |
| Creating supporting documentation for IT system audits | Highly Desired | 2 years |
| Creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans | Highly Desired | 2 years |
| Keylight experience | Highly Desired | 1 3+ years |
Primary Skills
Governance, Risk and Compliance (GRC), NIST Framework, Security Controls, System Security Plans (SSP), Authority to Operate (ATO), Disaster Recovery Plans (DRP), POA&M, IT Compliance, Risk Assessment, Incident Response, IT Audit Documentation, Keylight
