Senior Security & Compliance Analyst

Description:

The Senior Security & Compliance Analyst will provide, but not be limited to, the following activities and tasks.

Governance, Policy & Standards.

The Candidate Will:

Draft, revise, and maintain Department information security policies and standards (including the 420-series), and establish and operate periodic review cycles.

Develop procedures supporting Department security policies consistent with Rule 60GG-2.002 and 60GG-2.003, F.A.C. Develop and maintain control mappings and crosswalks among NIST SP 800-53, NIST CSF, and Rule 60GG-2, F.A.C.

Maintain documentation, version control, and review evidence sufficient to satisfy internal and external audit.

Risk Management & Assessment.

The Candidate Will:

Conduct security risk assessments and control gap analyses against applicable frameworks.

Develop, track, and maintain Plans of Action and Milestones (POA&Ms) and corrective action plans.

Perform third-party / vendor security risk reviews, including review of vendor security documentation, contract security terms, and integration security (identity federation, per-transaction attribution, and audit logging).

Security Operations & Engineering Support.

The Candidate Will:

Support configuration, hardening, and monitoring within Microsoft 365 and Microsoft Defender (Defender for Endpoint, Defender Vulnerability Management, Microsoft Purview) consistent with Department standards.

Support vulnerability management: triage, tracking, and coordination of remediation. Support incident response consistent with the Department's Cybersecurity Incident Response Policy (420.01), including documentation and post-incident analysis.

Support identity and access management activities, including access reviews and provisioning-integrity controls.

Audit, Compliance & Reporting.

The Candidate Will:

Support response to Office of Inspector General (IG) and external audit findings, including evidence collection, control testing, and development of management responses.

Support compliance with the CJIS Security Policy and protection of PHI and other confidential information.

Develop security metrics, status reporting, and security awareness materials; support security governance meetings and working groups.

Contract Deliverables:

The candidate shall provide evidence of performance through documentation including, but not limited to:

Drafted and revised security policies and standards, with documented periodic-review cycles.

Control mapping crosswalks (NIST SP 800-53 / NIST CSF / Rule 60GG-2, F.A.C.). Security risk assessment reports and control gap analyses.

Plans of Action and Milestones (POA&Ms) and corrective action plans.

Third-party / vendor security review memoranda and diagnostic question sets.

Vulnerability management tracking and remediation status reports.

Incident documentation and post-incident (Root Cause Analysis) reports.

Audit evidence packages and draft management responses to IG / external findings.

Security metrics and periodic status reports.

Education And Certification:

The candidate must possess, at a minimum, a Bachelor's degree in computer science, information systems, cybersecurity, or a related field, or equivalent work experience; and at least one current industry certification from the following (others may be considered): CISA - Certified Information Systems Auditor (strongly aligned to the GRC/audit core). CRISC - Certified in Risk and Information Systems Control. CGRC - Certified in Governance, Risk and Compliance (formerly CAP). CISM - Certified Information Security Manager. CISSP - Certified Information Systems Security Professional.

Minimum Qualifications:

QUALIFICATION REQUIREMENTS FOR SENIOR SECURITY & COMPLIANCE ANALYST

The Candidate Must Possess The Minimum Qualifications And Experience:

a minimum of four (4) years of combined IT and security work experience with a broad range of exposure to systems analysis, applications development, and database design and administration, including one to two (1-2) years of experience with information security, and knowledge of security issues, techniques, and implications across all existing computer platforms.