Cybersecurity Analyst (GRC)
About The Position
The Cybersecurity Analyst (GRC) is a member of the Office of Technology and Innovation’s Cyber Command Audit and Compliance Division, supporting Citywide cybersecurity risk, audit, and compliance programs. The analyst helps assess and shape New York City agencies’ cybersecurity risks and compliance posture, promotes compliance with Citywide cybersecurity policies, standards, procedures, and frameworks, and contributes to continual improvement of Cyber Command. The role includes participating in Citywide cybersecurity risk assessments and conducting risk-based audits and control evaluations across agency programs, projects, and initiatives. The position is based in Brooklyn, New York. The listed shift is day; because the position supports a 24/7 operation, the candidate may be required to work various shifts, including weekends and nights or evenings. The job posting describes the City’s benefits generally but does not specify particular benefits.
Requirements
- A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the position, or equivalent education and/or experience.
- Four years of satisfactory full-time related experience is specified in the stated qualification pathway.
Responsibilities
- Review security assessment and service performance reports to identify significant issues or variances and initiate corrective actions when necessary.
- Review and analyze cybersecurity risk cases, including agency-submitted justification and exception documents.
- Assist in developing cybersecurity risk and compliance assessment procedures and testing methodologies based on established frameworks and guidelines.
- Assess NYC agencies’ documented information security and technology policies, procedures, and practices.
- Evaluate cybersecurity programs or their components for compliance with Citywide cybersecurity policies and standards.
- Conduct risk-based cybersecurity audits of NYC agencies’ programs, projects, and initiatives, including evaluating the design and operating effectiveness of security controls.
- Execute audit procedures, perform technical and procedural control testing, evaluate supporting evidence, and document results according to established audit methodologies.
- Draft and present findings reports, working papers, concise control assessments, and systems testing reports in narrative and table formats.
- Prepare and maintain audit working papers supporting observations, findings, conclusions, and recommendations, and communicate audit results to stakeholders.
- Track and validate remediation of audit findings, cybersecurity control deficiencies, and compliance gaps.
- Analyze legal, regulatory, contractual, and policy requirements relevant to cybersecurity controls and compliance, and document gaps and recommendations.
- Communicate with NYC agencies to assist them in complying with Citywide policies and standards.
- Handle special projects and initiatives as assigned.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
