Stafford Gray is looking for a Senior IT Security Compliance Analyst for a contract role with a public-sector client in the Lansing area. You’ll be the senior compliance lead for a portfolio of agency applications. You’ll own System Security Plans and Disaster Recovery Plans, lead Authority to Operate (ATO) renewals, and act as the go-between for business partners, technical teams, security groups, auditors, and management.

What you’ll do

• Lead the maintenance and updating of System Security Plans (SSPs) so they’re accurate, complete, and aligned with NIST controls and the organization’s compliance standards.
• Plan and run the ATO renewal process on a three-year cycle. That means preparing materials, managing timelines, and making sure security controls stay validated between renewals.
• Work with stakeholders to track Plans of Action & Milestones (POA&Ms) and other compliance items through to reporting and closure.
• Review security risk assessment results, brief management, and recommend corrective actions.
• Assess the risk and scope of high-level security incidents. Lead mid- to high-level incident response, from detection and correlation through response and recovery.
• Build management reporting and trend analysis from security metrics across multiple business areas.
• Review existing compliance documentation, find gaps and risks, and guide the fixes.
• Coordinate with technical teams, business owners, enterprise security, vendors, auditors, and project leadership so that SSP and ATO evidence and artifacts are complete and current.
• Mentor team members and push for consistent, standardized compliance processes across all supported systems.

Requirements

Required

• 3+ years of Governance, Risk & Compliance (GRC) experience.
• 5+ years providing audit evidence for security standards such as NIST, PCI, HIPAA, or FERPA.
• Working knowledge of the NIST framework and controls.
• 5+ years of exposure to complex IT web applications, within the past 5 years.
• 5+ years leading meetings and delivering written and oral reports.
• 5+ years working as a liaison between business and IT areas.
• A bachelor’s degree in cybersecurity, information assurance, IT, or a related field, or 5 years of equivalent experience.
• Strong documentation and communication skills.

Highly desired

• 2+ years creating supporting documentation for IT system audits.
• 2+ years creating Disaster Recovery, Business Continuity, and Incident Response plans.
• Experience with Keylight or a comparable GRC platform, such as Archer, ServiceNow GRC, or LogicGate.
• An advanced degree in cybersecurity, information assurance, or IT leadership, or an MBA with an IT or security concentration.
• Security certifications such as CISSP, CISM, CISA, or CRISC.