Cybersecurity Analyst (GRC)
About The Position
The Office of Technology and Innovation (OTI) uses technology to improve public safety, expand opportunity, and strengthen city government. Its Cyber Command protects City systems from cyber threats and supports more than 100 agencies and offices. The Cybersecurity Analyst (GRC) serves in the Cyber Command Audit and Compliance Division, helping build and maintain Citywide cybersecurity risk, audit, and compliance programs. The analyst helps assess NYC agencies’ cybersecurity risks and compliance posture and supports adherence to Citywide cybersecurity policies, standards, procedures, and frameworks. The role includes reviewing security assessment and service performance reports, analyzing risk cases and agency-submitted justification or exception documents, and helping develop risk and compliance assessment procedures and testing methodologies. The analyst assesses agency information-security and technology policies and practices, conducts risk-based audits and control testing, documents and presents findings, and tracks remediation of deficiencies and compliance gaps. The analyst also analyzes relevant legal, regulatory, contractual, and policy requirements, communicates with agencies, and handles special projects as assigned. The position is based in Brooklyn, NY. The stated shift is day, but because Cyber Command operates 24/7, the candidate may be required to work various shifts, including weekends and nights or evenings.
Requirements
- A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the position, or equivalent education and/or experience.
- Ability to work various shifts, including weekends and nights/evenings, may be required due to the 24/7 operation.
Responsibilities
- Review security assessment and service performance reports, identify significant issues or variances, and initiate corrective actions where necessary.
- Review and analyze cybersecurity risk cases, including agency-submitted justification and exception documents.
- Assist in developing cybersecurity risk and compliance assessment procedures and testing methodologies based on established frameworks and guidelines.
- Assess NYC agencies’ documented information security and technology policies, procedures, and practices.
- Evaluate cybersecurity programs or their components for compliance with Citywide cybersecurity policies and standards.
- Conduct risk-based cybersecurity audits of NYC agencies’ programs, projects, and initiatives, including evaluating the design and operating effectiveness of security controls.
- Execute audit procedures, perform technical and procedural control testing, evaluate supporting evidence, and document results using established audit methodologies.
- Draft and present findings reports, working papers, control assessments, and systems testing reports in narrative and table formats.
- Prepare and maintain audit working papers supporting observations, findings, conclusions, and recommendations, and clearly communicate audit results to stakeholders.
- Track and validate remediation of audit findings, cybersecurity control deficiencies, and compliance gaps.
- Analyze legal, regulatory, contractual, and policy requirements relevant to cybersecurity controls and compliance, and document gaps and recommendations.
- Communicate with NYC agencies to assist them in complying with Citywide policies and standards.
- Handle special projects and initiatives as assigned.
Benefits
- The employer describes offering great benefits but does not specify individual benefits.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
