SLED Security Analyst, Information Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Overseeing and sustaining all documentation, governance activities, compliance initiatives, and operational processes essential for achieving and retaining security authorizations and certifications that cater to State, Local, Education, and Government (SLED) clients.

• Directing the creation and upkeep of security architecture, governance frameworks, policies, standards, procedures, and guidance for control implementation.

• Assisting security authorization efforts in alignment with NIST SP 800-53 Moderate, FedRAMP Moderate, GovRAMP, StateRAMP, CJIS Security Policy, HIPAA, NIST SP 800-171, and other relevant regulatory frameworks.

• Compiling, creating, maintaining, and revising System Security Plans (SSP), supporting documents, and authorization package artifacts.

• Aligning implemented security control requirements with NIST SP 800-53 Moderate baselines, CJIS Security Policy, FedRAMP, GovRAMP, and other applicable control overlays.

• Gathering, validating, organizing, and preserving technical, administrative, and procedural evidence that supports compliance and assessment undertakings.

• Creating and managing centralized repositories for control evidence using governance and compliance management platforms like Vanta or similar technologies.

• Assisting independent assessors, auditors, regulators, customers, and internal stakeholders during assessments, walkthroughs, interviews, demonstrations, and evidence evaluations.

• Formulating, maintaining, and monitoring Plan of Action and Milestones (POA&M) documentation, remediation activities, corrective action plans, and risk mitigation strategies.

• Monitoring security findings, compliance deficiencies, remediation tasks, risk acceptances, and corrective action plans until resolution.

• Reviewing existing information security policies, standards, procedures, and governance documentation, providing recommendations for improvements to ensure compliance with relevant frameworks.

• Creating, maintaining, and revising compliance-aligned policies, standards, procedures, and governance documentation to support authorization preparedness.

• Defining roles, responsibilities, accountability requirements, and separation-of-duty controls that bolster governance and compliance initiatives.

• Establishing processes that enhance risk management, control assessment, continuous monitoring, and control validation.

• Developing and updating Incident Response Plans (IRP), incident response protocols, and incident response playbooks in accordance with regulatory reporting and notification mandates.

⛳️ Requirements

• Associate degree (ideally in Computer Science, Cybersecurity, Information Systems, Information Security, or a related field from an accredited institution) or equivalent work experience and/or military background.

• Over 3 years of experience in supporting information security, governance, risk, compliance, audit, or authorization programs.

• One or more security certifications such as Security+, CISSP, CISA, CGRC (CAP), CRISC, CASP+, CCSP, GIAC, CSA, or their equivalents.

• Experience with NIST SP 800-53 Moderate, FedRAMP, GovRAMP, StateRAMP, CJIS Security Policy, NIST Cybersecurity Framework (CSF), NIST SP 800-171, HIPAA, or other SLED-related compliance programs.

• Proficient in developing and maintaining System Security Plans (SSP), POA&M documentation, security policies, standards, procedures, and authorization artifacts.

• Intermediate to advanced technical writing proficiency demonstrated through the production of compliance and governance documentation.

• Experience in supporting independent assessments, audits, reviews, and authorization processes.

• Familiarity with governance, risk, and compliance platforms including Vanta, Drata, Archer, ServiceNow, or similar technologies.

• Understanding of technical concepts and security technologies such as cloud computing, identity and access management, VPNs, firewalls, web application firewalls, vulnerability management, endpoint protection, logging, monitoring, and network security controls.

• Competence in project prioritization, issue management, remediation tracking, risk assessment, and problem-solving.

• Outstanding writing capabilities coupled with strong presentation and communication skills.

• Exceptional analytical thinking abilities, including the capacity to summarize information and distinctly identify risks, findings, trends, and remediation needs.

• Experience in creating, generating, maintaining, and reporting on compliance metrics, audit evidence, control documentation, and security reporting.

• Familiarity with utilizing artificial intelligence tools and technologies to enhance documentation, compliance operations, and security processes.

• Ability to manage multiple projects, priorities, audits, and compliance initiatives concurrently.

• Capacity to communicate and convey security risks to both technical and non-technical audiences.

• Skill in analyzing complex security and compliance challenges and formulating practical solutions.

🏝️ Benefits

• Health insurance

• 401(k) matching

• Flexible working hours

• Paid time off

• Remote work options