Cybersecurity Compliance Analyst

Texas Health & Human Services Commission•Austin, TX

7d•$7,015 - $10,417•Hybrid

About The Position

This position is open to U.S. Citizens and permanent residents. This onsite role requires the selected candidate to work from an HHS office in Austin, Texas. The Cybersecurity Compliance Analyst performs professional-level work supporting cybersecurity compliance, audit coordination, policy and standards, publication, and procurement and contract support. The position supports alignment with applicable regulatory and policy requirements, strengthens compliance readiness, and promotes integration of security controls and statues within enterprise governance and external business engagements. This position is responsible for interpreting regulatory changes, legislative reviews, state and federal laws, analyzing materials for applicability to agency requirements, and supporting enterprise cybersecurity governance activities. Work includes assisting with compliance implementation, research and analyses, critical thinking, accountability, audit task, agency publication management, documentation management, and incorporation of security requirements into procurement and third-party business processes. This position performs highly complex information security and cybersecurity analysis work. Works under limited supervision, with considerable latitude for the use of initiative and independent judgment. The position is responsible for research and implement new security risk and mitigation strategies, tools, techniques, and solutions for the prevention, detection, containment, and correction of data security breaches.

Requirements

Bachelor’s degree in information security, Information Technology, or related field, or equivalent experience on a year-for-year basis.
Minimum of five (5) years of experience in cybersecurity governance, risk management, or compliance.
Experience implementing RMF and security authorization processes.
Experience working with enterprise GRC and IT service management tools.
Knowledge of cybersecurity governance, risk, and compliance principles, including security control frameworks, regulatory requirements, agency policies, standards, procedures, audit support practices, and third-party security review concepts.
Knowledge of applicable cybersecurity and compliance requirements, including NIST SP 800-53, Texas Department of Information Resources requirements, TAC 202, CJIS, IRS Publication 1075, privacy requirements, data protection expectations, and related legal or regulatory obligations.
Skill in interpreting regulatory, statutory, technical, and policy requirements; assessing applicability to agency operations; identifying gaps, risks, and dependencies; and documenting clear, supportable compliance recommendations.
Skill in developing, reviewing, maintaining, and organizing cybersecurity policies, standards, procedures, implementation guidance, publications, evidence repositories, trackers, decision logs, and other governance artifacts.
Skill in coordinating audit readiness activities, collecting and validating evidence, supporting corrective action plans, tracking remediation, and maintaining documentation that demonstrates compliance and supports audit closure.
Skill in reviewing procurement, contract, vendor, data use, and third-party security documentation to ensure security controls, reporting expectations, data protection requirements, and compliance obligations are appropriately documented and traceable.
Ability to compile, analyze, correlate, and evaluate technical and non-technical information, including evidentiary materials, regulatory references, security documentation, and operational data, to support sound compliance and risk-based decisions.
Ability to communicate complex cybersecurity, compliance, audit, and risk information clearly and professionally to technical, business, procurement, legal, privacy, contract management, and executive stakeholders.
Ability to manage multiple priorities, meet deadlines, maintain accountability for assigned tasks, coordinate cross-functional activities, and escalate risks, issues, or overdue items in a timely and appropriate manner.
Ability to interpret, evaluate, and apply regulatory, statutory, technical, privacy, and security requirements to agency policies, standards, procedures, procurement activities, and audit documentation.
Ability to manage documentation, evidence, trackers, version history, approvals, and supporting artifacts in a manner that promotes accuracy, consistency, traceability, audit readiness, and accountability.
Ability to identify process gaps, recommend practical improvements, strengthen governance practices, and support maturity of cybersecurity compliance, policy management, audit readiness, and third-party security processes.
Ability to communicate cybersecurity risk, compliance obligations, audit concerns, and policy requirements in a clear business language that supports informed decision-making and timely action.
Ability to facilitate governance meetings, working sessions, document reviews, audit discussions, and follow-up activities with clear agendas, documented outcomes, action tracking, and appropriate escalation.
Ability to build effective working relationships across technical teams, business programs, procurement, legal, privacy, contract management, vendors, auditors, and executive stakeholders.
Ability to prepare clear, accurate, and professional written materials, including summaries, status updates, policy language, audit responses, guidance documents, meeting notes, and executive-ready communications.
Ability to maintain confidentiality, protect sensitive information, and support the security and integrity of critical infrastructure systems by ensuring compliance with applicable laws, regulations, policies, and security requirements

Nice To Haves

Experience in public sector or healthcare security governance environments.
Experience with audit, procurement or contract support

Responsibilities

Supports administration and maturity of the information security compliance program by coordinating compliance activities, tracking deliverables, maintaining governance documentation, and ensuring assigned tasks are completed accurately and timely.
Reviews penetration testing results, supports vulnerability remediation efforts, and uses security tools to evaluate and track risk.
Analyzes regulatory, statutory, state, federal, and agency security requirements to determine applicability, assess impacts, and communicate compliance with obligations, risks, and recommend appropriate stakeholders.
Maintains authoritative compliance records, trackers, evidence repositories, decision logs, and supporting documentation to promote consistency, traceability, audit readiness, and executive-level visibility into compliance status.
Provides governance support by preparing meeting materials, documenting decisions, coordinating follow-up actions, monitoring compliance initiatives, and escalating risks, dependencies, or overdue items as appropriate.
Documents project scope, objectives, assumptions, timelines, deliverables, risks, and status updates for assigned compliance and governance tasks; coordinates resources and stakeholder communications to support successful and accountable execution.
Conducts detailed research and review of technical and non-technical information, evidentiary materials, legal and regulatory references, and supporting documentation; applies analytical methods to identify, organize, correlate, and document information for compliance with NIST SP 800-53, Texas Department of Information Resources (DIR) requirements, Criminal Justice Information Services (CJIS), IRS Publication 1075, privacy requirements, security policy requirements, applicable legal standards, and proposed legislative impacts.
Leads and supports review, development, maintenance, and publication of cybersecurity policies, processes, standards, procedures, and guidance to ensure alignment with TAC 202, enterprise security requirements, regulatory obligations, and operational needs.
Evaluates security, regulatory, privacy, data protection, and operational requirements to identify gaps, inconsistencies, outdated language, or control deficiencies in existing policies, processes, standards, and publications.
Research emerging cybersecurity topics, technologies, regulatory trends, and industry practices, including cloud services, artificial intelligence, data protection, and third-party risk, and incorporates findings into agency policies, standards, processes, and guidance materials.
Coordinates updates, reviews, approvals, version control, and lifecycle maintenance of cybersecurity policies, standards, processes, and publications to ensure artifacts remain current, accurate, enforceable, and auditable.
Develops and maintains security implementation guidance, control language, compliance references, and procedural materials that promote consistent interpretation, implementation, monitoring, and auditability of security requirements.
Ensures IT security publications, procedures, guidelines, templates, reference materials, and knowledge artifacts are organized, accessible, consistently formatted, and aligned with agency governance and compliance expectations.
Coordinates audit readiness activities by collecting, validating, organizing, and maintaining evidence mapped to applicable policies, standards, processes, regulatory requirements, and control expectations.
Reviews audit evidence and supporting documentation for completeness, accuracy, consistency, and alignment with established security policies, procedures, standards, and control requirements; identifies discrepancies and escalates issues as needed.
Supports stakeholders in responding to audit requests, control inquiries, corrective action plans, and remediation activities by interpreting applicable security requirements and referencing approved policy, process, standard, and publication artifacts.
Tracks audit findings, management responses, remediation actions, target dates, evidence updates, and closure documentation; supports updates to policies, processes, and standards, and published guidance to prevent recurrence and strengthen compliance posture.
Supports risk management framework activities by assisting with categorization, control identification, documentation review, risk tracking, evidence collection, and coordination of security requirements throughout the system or vendor lifecycle. Including POA&M, RBD and document entries in Archer GRC.
Reviews third-party security documentation, including data use agreements, memoranda of understanding, security exhibits, contract terms, attestations, and vendor-provided materials, to assess alignment with agency policies, standards, privacy requirements, and published security expectations.
Supports procurement, contract, and vendor review activities by verifying that required security controls, deliverables, reporting obligations, data protection requirements, and policy-based expectations are documented and traceable.
Ensures security expectations are incorporated into procurement documentation, vendor communications, standards, procedures, formal publications, and other governance artifacts where applicable.
Collaborates with security, IT, legal, procurement, privacy, contract management, and business stakeholders to promote consistent implementation, understanding, and documentation of security requirements across third-party engagements.
Performs other duties as assigned within the scope of the position, including activities that support cybersecurity governance, compliance, audit readiness, policy maintenance, risk management, and agency operational needs.