Information Security Analyst Sr

Travis County • Austin, TX

1d • Hybrid

About The Position

Travis County Technology and Operations is seeking an Information Security Analyst Sr to join the Enterprise Risk Management Division. Performs advanced information security, compliance, risk management, and audit activities in support of the County's Information Assurance and cybersecurity programs. Serves as a senior-level subject matter resource for assessing compliance with information security requirements, with significant responsibility for supporting the County's Criminal Justice Information Services (CJIS) compliance program and evaluating compliance with the FBI CJIS Security Policy. Plans and conducts technical and administrative security assessments and audits; evaluates security controls; identifies compliance gaps and risks; develops findings and recommendations; and monitors corrective action and remediation activities. Assists County departments with interpreting and implementing applicable security requirements, including CJIS, NIST, HIPAA, County policies, and other regulatory or contractual requirements. Conducts information technology risk assessments and evaluates administrative, technical, and physical safeguards protecting County systems and information. Reviews system configurations, policies, procedures, documentation, audit records, access controls, security architecture, and supporting evidence to determine whether security controls are appropriately designed, implemented, and operating as intended. Develops assessment methodologies, audit procedures, control checklists, compliance documentation, risk reports, and executive-level summaries. Collaborates with County departments, Information Technology personnel, information security staff, departmental security representatives, management, vendors, auditors, and external agencies to strengthen security governance and maintain regulatory compliance. This position is eligible for teleworking, in office as needed. This is a senior-level information security classification within the Information Technology job family. Incumbents perform complex information security, compliance, audit, and risk management activities requiring advanced knowledge of cybersecurity principles, regulatory requirements, security frameworks, and information technology controls. The Information Security Analyst Senior exercises considerable independent judgment in planning and conducting security assessments and audits, interpreting security and compliance requirements, evaluating technical and administrative controls, identifying deficiencies and risks, and developing recommendations for corrective action. The position will serve as a subject matter resource for the County's Criminal Justice Information Services (CJIS) compliance program and will coordinate compliance and audit activities across multiple County departments that access, process, store, transmit, or support Criminal Justice Information (CJI). Responsibilities may include assessing compliance with the FBI CJIS Security Policy, preparing departments for internal and external audits, documenting findings, monitoring remediation activities, and assisting departments with implementation of required security controls. This classification may lead projects, mentor or provide technical guidance to other staff, and represent the department in meetings with County departments, auditors, regulatory entities, vendors, and other governmental agencies. This classification may require a flexible work schedule to meet operational or audit requirements.

Requirements

• Bachelor's degree in Computer Science, Information Systems, Business Administration or a directly related field AND five (5) years of relevant work experience, including at least three (3) years experience in information security; OR, Any combination of education and experience that has been achieved and is equivalent to the stated education and experience and required knowledge, skills, and abilities sufficient to successfully perform the duties and responsibilities of this job.
• Valid Texas Driver's License.
• Knowledge of: Information security governance, risk management, compliance, and audit principles and practices.
• Knowledge of: FBI Criminal Justice Information Services (CJIS) Security Policy requirements and security controls applicable to systems that access, process, store, or transmit Criminal Justice Information.
• Knowledge of: National Institute of Standards and Technology (NIST) cybersecurity standards and frameworks, including NIST SP 800-53, NIST AI RMF, NIST CSF 2.0, and related security control assessment and risk management concepts.
• Knowledge of: Federal, State, Local and County applicable laws, regulations, policies, standards, and contractual requirements applicable to information security and privacy, including the Health Insurance Portability and Accountability Act (HIPAA).
• Knowledge of: Information security audit methodologies, evidence collection techniques, control testing, sampling, documentation, workpapers, findings development, and corrective action monitoring.
• Knowledge of: Information technology risk assessment and risk management methodologies, including qualitative and quantitative approaches.
• Knowledge of: Security control design, implementation, assessment, monitoring, and remediation.
• Knowledge of: Data protection concepts including encryption, cryptographic controls, data classification, data loss prevention, removable media protection, transmission security, and secure disposal.
• Knowledge of: Third-party and vendor cybersecurity risk management.
• Knowledge of: Cloud computing and Software-as-a-Service security concepts and shared responsibility models.
• Knowledge of: Principles and practices for developing security policies, standards, procedures, guidelines, and technical documentation.
• Knowledge of: Methods for communicating technical, security, risk, and compliance information to technical and non-technical audiences.
• Knowledge of: Computer equipment to include word processing, spreadsheets, databases and a variety of software packages.
• Skill in: Conducting information security audits, compliance assessments, security control assessments, and information technology risk assessments.
• Skill in: Interpreting and applying cybersecurity frameworks, regulatory requirements, policies, standards, and technical requirements.
• Skill in: Evaluating administrative, technical, and physical security controls and determining whether sufficient evidence demonstrates compliance.
• Skill in: Identifying control deficiencies, analyzing associated risk, determining root causes, and developing practical recommendations for corrective action.
• Skill in: Developing audit workpapers, assessment documentation, findings, risk statements, corrective action plans, and executive-level reports.
• Skill in: Collecting, reviewing, analyzing, and documenting technical and administrative evidence.
• Skill in: Researching cybersecurity requirements and applying them to complex information technology environments.
• Skill in: Managing multiple assessments, audits, findings, and remediation activities simultaneously.
• Skill in: Communicating complex technical and regulatory requirements in clear, understandable language to technical and non-technical audiences.
• Skill in: Providing consultation, guidance, training, and technical assistance to County departments and stakeholders.
• Skill in: Building collaborative working relationships across organizational and departmental boundaries.
• Skill in: Problem-solving, critical thinking, analysis, and independent decision-making.
• Skill in: Preparing and delivering professional written reports, presentations, briefings, and recommendations.
• Ability to: Interpret complex cybersecurity policies, standards, laws, regulations, and contractual requirements and translate them into measurable security controls and operational requirements.
• Ability to: Independently plan, organize, conduct, document, and report information security audits, assessments, and risk analyses.
• Ability to: Evaluate evidence objectively and determine whether security controls are appropriately designed, implemented, and operating effectively.
• Ability to: Identify and clearly articulate security control deficiencies, compliance gaps, risks, and recommended corrective actions.
• Ability to: Apply CJIS Security Policy requirements to diverse technical environments, business processes, County departments, and information systems.
• Ability to: Communicate audit findings and security risks professionally and effectively.
• Ability to: Work collaboratively with technical personnel, departmental leadership, auditors, vendors, legal counsel, risk management personnel, and other governmental entities.
• Ability to: Maintain independence, objectivity, confidentiality, and professional judgment when conducting audits and assessments.
• Ability to: Manage multiple complex assignments, prioritize competing requirements, meet deadlines, and maintain accurate assessment and compliance documentation.
• Ability to: Research, compile, analyze, interpret, and present complex technical and regulatory information.
• Ability to: Develop practical recommendations that balance security and compliance requirements with operational and business needs.
• Ability to: Provide guidance, mentoring, and technical assistance to other staff.
• Ability to: Establish and maintain effective working relationships with County departments, elected and appointed officials, external agencies, vendors, auditors, and other stakeholders.
• Ability to: Work independently with limited supervision while contributing effectively as a member of multidisciplinary teams.

Nice To Haves

• Industry-recognized certification such as CompTIA Security+, Certified Information Systems Auditor (CISA), Certified Risk and Information Systems Control (CRISC), or Certified Governance Risk & Compliance (CGRC)

Responsibilities

• Plans, conducts, documents, and reports information security compliance assessments, technical and administrative audits, and risk assessments of County departments, systems, applications, processes, and third-party services.
• Supports administration of the County's Criminal Justice Information Services (CJIS) compliance program and evaluates compliance with applicable FBI CJIS Security Policy requirements.
• Conducts CJIS compliance assessments and internal audits of multiple County departments and systems that access, process, store, transmit, or support Criminal Justice Information (CJI).
• Develops and maintains audit methodologies, assessment procedures, evidence requirements, control checklists, questionnaires, workpapers, compliance documentation, and other tools necessary to evaluate and demonstrate compliance.
• Coordinates audit preparation and evidence collection activities with County departments, Information Technology personnel, departmental security representatives, management, vendors, and other stakeholders.
• Reviews policies, procedures, system configurations, access controls, security documentation, audit logs, network and system architecture, data flows, training records, personnel security documentation, incident response processes, physical safeguards, and other evidence to determine compliance with applicable requirements.
• Documents audit and assessment findings, identifies control deficiencies and associated risks, develops recommendations for corrective action, and communicates results to technical personnel, departmental management, and executive leadership.
• Develops, tracks, and monitors corrective action plans, plans of action and milestones (POA&Ms), risk treatment activities, exceptions, and other remediation efforts resulting from security assessments and audits.
• Performs follow-up assessments to validate that corrective actions have been implemented and identified security deficiencies have been appropriately addressed.
• Assists County departments with interpreting CJIS Security Policy requirements and translating security requirements into practical administrative, technical, and operational controls.
• Supports County preparation for external CJIS audits and assessments, including coordinating evidence collection, reviewing documentation, facilitating interviews, responding to audit requests, documenting findings, and monitoring corrective actions.
• Conducts information technology and cybersecurity risk assessments using qualitative and quantitative methodologies and evaluates risks associated with systems, applications, technology services, vendors, business processes, and security control deficiencies.
• Evaluates administrative, technical, and physical security controls against applicable laws, regulations, contractual requirements, County policies, and recognized cybersecurity frameworks and standards.
• Reviews proposed and existing technologies to identify security, privacy, regulatory, and compliance risks and recommends appropriate safeguards and risk treatment measures.
• Develops and maintains information security policies, standards, procedures, guidelines, assessment methodologies, and supporting documentation based on changes in technology, threats, regulatory requirements, and industry standards.
• Analyzes changes to the FBI CJIS Security Policy and other applicable cybersecurity requirements and evaluates their impact on County systems, departments, policies, procedures, and security controls.
• Prepares technical reports, risk assessments, audit reports, compliance reports, dashboards, presentations, executive summaries, and other documentation communicating security risks, findings, remediation status, and compliance posture.
• Collaborates with information security, Information Technology, privacy, legal, risk management, departmental personnel, and external organizations regarding cybersecurity risk and compliance matters.
• Provides consultation, guidance, training, and awareness to County departments regarding information security requirements, CJIS compliance responsibilities, security controls, and audit readiness.
• Participates in security governance, risk management, compliance, incident response, business continuity, and other Information Assurance initiatives as assigned.
• May lead projects, mentor staff, review work performed by other analysts, and provide technical or compliance guidance to junior staff.
• Performs other job-related duties as assigned.

Benefits

• Travis County employees play an important role in business continuity. As such, employees can be assigned to business continuity efforts outside of normal job functions.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior