SLED Security Analyst, Information Security

This is a fully remote position, open to applicants in United States.

📋 Description

• This role entails overseeing and upholding all documentation, governance activities, compliance initiatives, and operational processes essential for achieving and maintaining security authorizations and certifications for State, Local, Education, and Government (SLED) clients.

• Directs the creation and upkeep of security architecture, governance frameworks, policies, standards, procedures, and guidance for control implementation.

• Aids security authorization efforts in accordance with NIST SP 800-53 Moderate, FedRAMP Moderate, GovRAMP, StateRAMP, CJIS Security Policy, HIPAA, NIST SP 800-171, and other relevant regulatory frameworks.

• Gathers, develops, maintains, and revises System Security Plans (SSP), related documentation, and authorization package artifacts.

• Aligns implemented security control requirements with NIST SP 800-53 Moderate baselines, CJIS Security Policy, FedRAMP, GovRAMP, and other pertinent control overlays.

• Records implemented, inherited, hybrid, and customer-responsibility controls within authorization packages.

• Collects, verifies, organizes, and retains technical, administrative, and procedural evidence to support compliance and assessment activities.

• Establishes and sustains centralized repositories for control evidence using governance and compliance management platforms like Vanta or equivalent technologies.

• Assists independent assessors, auditors, regulators, clients, and internal stakeholders during assessments, walkthroughs, interviews, demonstrations, and evidence evaluations.

• Develops, maintains, and monitors Plan of Action and Milestones (POA&M) documentation, remediation activities, corrective action plans, and risk mitigation strategies.

• Keeps track of security findings, compliance deficiencies, remediation efforts, risk acceptances, and corrective action plans until resolved.

⛳️ Requirements

• An associate degree (ideally in Computer Science, Cybersecurity, Information Systems, Information Security, or a related field from an accredited institution) or equivalent work and/or military experience.

• Over 3 years of experience in supporting information security, governance, risk, compliance, audit, or authorization programs.

• One or more security certifications such as Security+, CISSP, CISA, CGRC (CAP), CRISC, CASP+, CCSP, GIAC, CSA, or a comparable credential.

• Experience in supporting NIST SP 800-53 Moderate, FedRAMP, GovRAMP, StateRAMP, CJIS Security Policy, NIST Cybersecurity Framework (CSF), NIST SP 800-171, HIPAA, or other SLED-related compliance initiatives.

• Proven experience in developing and maintaining System Security Plans (SSP), POA&M documentation, security policies, standards, procedures, and authorization artifacts.

• Intermediate to advanced technical writing capabilities with a track record of producing compliance and governance documentation.

• Background in assisting with independent assessments, audits, reviews, and authorization activities.

• Familiarity with governance, risk, and compliance platforms such as Vanta, Drata, Archer, ServiceNow, or similar technologies.

• Solid understanding of technical concepts and security technologies including cloud computing, identity and access management, VPNs, firewalls, web application firewalls, vulnerability management, endpoint protection, logging, monitoring, and network security controls.

• Proficient in project prioritization, issue management, remediation tracking, risk assessment, and resolving problems.

• Outstanding writing skills complemented by strong presentation and communication abilities.

• Advanced analytical thinking skills, including the capacity to summarize information and clearly identify risks, findings, trends, and remediation needs.

• Experience in creating, generating, maintaining, and reporting on compliance metrics, audit evidence, control documentation, and security reporting.

• Familiarity with utilizing artificial intelligence tools and technologies to enhance documentation, compliance operations, and security processes.

• Capability to manage multiple projects, priorities, audits, and compliance initiatives concurrently.

• Proficiency in communicating and conveying security risks to both technical and non-technical audiences.

• Ability to analyze complex security and compliance challenges and devise practical solutions.

🏝️ Benefits

• Health insurance

• 401(k) matching

• Flexible working hours

• Paid time off

• Remote work options