Cybersecurity Analyst (GRC)
About The Position
The Office of Technology and Innovation (OTI) uses technology to improve public safety, expand opportunity, and support city government. Within OTI, Cyber Command protects City systems from cyber threats and supports more than 100 agencies and offices. The Cybersecurity Analyst (GRC) serves in the Cyber Command Audit and Compliance Division, helping build and maintain Citywide cybersecurity risk, audit, and compliance programs and participating in Citywide cybersecurity risk assessments. The Analyst assesses NYC agencies’ cybersecurity risks and compliance posture and supports enforcement of Citywide cybersecurity policies, standards, procedures, and frameworks. The role conducts risk-based audits and control testing, documents and communicates findings, and tracks remediation. The position is based in Brooklyn, NY. The stated shift is day; because Cyber Command operates 24/7, various shifts, including weekends and nights/evenings, may be required.
Requirements
- A bachelor’s degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the position, or equivalent education and/or experience.
- Four years of experience is specified in the listed qualification; the posting also permits equivalent education and/or experience.
Responsibilities
- Review security assessment and service performance reports for significant issues or variances and initiate corrective actions when necessary.
- Review and analyze cybersecurity risk cases, including agency justification and exception documents.
- Assist in developing cybersecurity risk and compliance assessment procedures and testing methodologies based on established frameworks and guidelines.
- Assess NYC agencies’ documented information security and technology policies, procedures, and practices.
- Evaluate cybersecurity programs or components for compliance with Citywide cybersecurity policies and standards.
- Conduct risk-based cybersecurity audits of NYC agency programs, projects, and initiatives, including evaluation of security control design and operating effectiveness.
- Execute audit procedures, perform technical and procedural control testing, evaluate supporting evidence, and document results in accordance with established audit methodologies.
- Draft and present findings reports with working papers, concise control assessments, and narrative or table-based systems testing reports.
- Prepare and maintain audit working papers supporting observations, findings, conclusions, and recommendations, and communicate audit results to stakeholders.
- Track and validate remediation of audit findings, cybersecurity control deficiencies, and compliance gaps.
- Analyze legal, regulatory, contractual, and policy requirements relevant to cybersecurity controls and compliance; document gaps and related recommendations.
- Communicate with NYC agencies to assist them in complying with Citywide policies and standards.
- Handle special projects and initiatives as assigned.
Benefits
- The posting states that OTI offers great benefits, but does not specify individual benefits.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
