Cybersecurity Analyst (GRC)

City of New York•New York City, NY

4d•Onsite

About The Position

The Office of Technology and Innovation (OTI) uses technology to improve opportunity, public safety, and government services across New York City. Cyber Command protects City systems from cyber threats and supports more than 100 agencies and offices. The Cybersecurity Analyst (GRC) serves within Cyber Command’s Audit and Compliance Division, helping build and maintain Citywide cybersecurity risk, audit, and compliance programs. The Analyst contributes to continuous improvement and Citywide cybersecurity risk assessments, assesses agency cybersecurity risks and compliance, and supports enforcement of Citywide policies, standards, procedures, and cybersecurity frameworks.

Requirements

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the position, or equivalent education and/or experience.

Responsibilities

Review security assessment and service performance reports to identify significant issues or variances and initiate corrective actions when necessary.
Review and analyze cybersecurity risk cases, including agency-submitted justification and exception documents.
Assist in developing cybersecurity risk and compliance assessment procedures and testing methodologies based on established frameworks and guidelines.
Assess NYC agencies’ documented information security and technology policies, procedures, and practices.
Evaluate cybersecurity programs or their components for compliance with Citywide cybersecurity policies and standards.
Conduct risk-based cybersecurity audits of agency programs, projects, and initiatives, including evaluating the design and operating effectiveness of security controls.
Execute audit procedures, perform technical and procedural control testing, evaluate supporting evidence, and document results according to established audit methodologies.
Draft and present finding reports with working papers, concise control assessments, and narrative and table-based systems testing reports.
Prepare and maintain audit working papers supporting observations, findings, conclusions, and recommendations, and communicate audit results clearly to stakeholders.
Track and validate remediation of audit findings, cybersecurity control deficiencies, and compliance gaps.
Analyze legal, regulatory, contractual, and policy requirements relevant to cybersecurity controls and compliance, and support documentation of compliance gaps and recommendations.
Communicate with NYC agencies to assist them in complying with Citywide policies and standards.
Handle special projects and initiatives as assigned.