Cybersecurity Governance & Risk Analyst

TX-HHSC-DSHS-DFPS•Austin, TX

1d•$7,015 - $10,472•Onsite

About The Position

The Cybersecurity Analyst III performs senior-level security work with emphasis on cloud security, web application protection, and governance, risk, and compliance (GRC). The role supports on-premises and cloud environments by evaluating, implementing, and monitoring security controls to protect agency systems and data. Governance & Risk role is responsible for leading the enterprise cybersecurity governance framework and enterprise risk-management activities to ensure full alignment with legislative mandates, NIST 800‑53, HIPAA, and State of Texas DIR mandates. This position provides senior-level expertise in secure architecture standards, vendor risk management, and data governance. Ensuring that cybersecurity policies, controls, and risk-management practices are upheld and aligned with State of Tx DIR, NIST 800‑53, agency objectives, and regulatory requirements. The Governance & Risk Analyst advises on regulatory changes, develops the enterprise system risk posture, stays current with industry’s best practices and emerging technologies, participates in compliance and regulatory audits, and supports the implementation of enterprise security improvements. This position serves as a critical architect of the agency’s security policy framework, ensuring that every vendor, system architecture, and data flow aligns with legislative requirements and adheres to agency governance standards. This position performs highly complex information security and cybersecurity analysis work. Works under limited supervision, with considerable latitude for the use of initiative and independent judgment. May research and implement new security risk and mitigation strategies, tools, techniques, and solutions for the prevention, detection, containment, and correction of data security breaches. Reviews penetration testing results, supports vulnerability remediation efforts, and uses security tools to evaluate and track risk. The Analyst also provides expert guidance on HHS Security Policy, TAC 202, HIPAA, and other applicable regulations; partners with program, security, project managers, and technical teams; and supports staff on security, risk, and compliance matters.

Requirements

Graduation from an accredited four-year college or university with major coursework in information technology security, computer information systems, computer science, management information systems, or a related field is strongly preferred. Education and experience may be substituted for one another.
At least 5+ years of experience in information technology, security risk, management, assessment, auditing, project management, or consulting.
Experience in researching, authoring, or supporting the development of information security policies and standards.
Experience developing security and risk performance metrics and reporting dashboards for executive, business, and technical audiences.
Knowledge of information security risk assessment and security assessment methodologies, processes, and audit practices.
Knowledge of security program policies, standards, controls, and procedural requirements.
Knowledge of networking, operating systems, applications, databases, and related technologies, including wireless and mobile environments.
Knowledge of incident response concepts, practices, and procedures.
Knowledge of Secure Software/System Development Lifecycle (S‑SDLC) methodologies.
Knowledge of regulatory and compliance requirements, including HIPAA/HITECH, PCI, SOX, TAC 202, IRS Publication 1075, Texas Business and Commerce Code, and Texas Health and Safety Code.
Knowledge of security and risk management frameworks such as NIST, SANS, HITRUST, ISO, and COBIT.
Skill in written and verbal communication.
Skill in analyzing and solving complex problems and quickly understanding technical concepts.
Skill in developing, implementing, and maintaining information security policies, standards, and controls.
Skill in performing risk assessments, security assessments, and audits.
Skill in evaluating risks and identifying mitigation strategies, including defining compensating controls.
Ability to interpret and apply regulatory, policy, and security framework requirements.
Ability to communicate technical information to both technical and non‑technical audiences.
Ability to work collaboratively with diverse teams and guide others in information security practices.

Nice To Haves

Certified Information Systems Security Professional (CISSP)
Certified Information Systems Auditor (CISA)
Certified in Risk and Information Systems Control (CRISC)
Certified Information Systems Manager (CISM)
Global Information Assurance Certification (GIAC)
Project Management Professional (PMP)

Responsibilities

Performs reviews and risk management for vendors, system architectures, and data flows to advise and help teams comply with governance and regulatory standards.
Reviews regulatory and legislative changes and develops roadmaps for required updates to policy and governance structures. Ensures alignment with NIST 800‑53, State of Texas DIR mandates, HIPAA, TAC 202, and agency legislative requirements.
Using established risk management methodologies, identifies enterprise policy or control needs, and evaluates the effectiveness of security solutions across assigned governance areas.
Develops and maintains the enterprise system risk posture, including risk identification, assessment, metrics, and documentation.
Oversees vendor risk management activities, including third‑party assessments, contract security requirements, and ongoing monitoring.
Ensures risk‑management practices are aligned with agency objectives and federal/state requirements.
Develop vendor, procurement, or supply chain training. Promotes secure system and data safeguards.
Provides senior‑level guidance on secure architecture, cloud security, and application protection; evaluates and monitors security controls to protect agency systems and data.
Advises programs and technical teams on security technical compliance, governance requirements; supports enterprise security improvement initiatives.
Uses established standards and processes to adequately protect Health and Human Services (HHS) personnel, facilities, cloud infrastructure, information, and business operations.
Provide leadership and mentorship to other security analysts, offering guidance in performing assessments, implementing controls, and carrying out security functions.
Incorporates audit findings and identified security gaps into remediation planning; assists with special projects, documentation updates, and process improvements as assigned.
Reviews project charters, provides input on strategic initiatives, and assists with planning activities that strengthen the agency’s cybersecurity posture.
Performs additional cybersecurity, governance, and risk‑related tasks as assigned, including supporting special projects, contributing to process improvements, and assisting with agency initiatives that enhance overall security posture.