Information Security Analyst

Codetech•Phoenix, AZ

About The Position

The Department of Economic Security, Division of Technology Services, is seeking an experienced Information Security Analyst contractor to join the Governance Risk and Compliance (GRC) Team. The role engages with business units to understand reporting, data, and product needs and collaborates across departments to define project requirements, identify data dependencies and relationships, and develop data models, data flows, and system activity diagrams. It also involves writing specifications for enterprise information policies and supporting user adoption, training, and customer service through regular contact with users across divisions, programs, and service units. The analyst supports technical project managers by ensuring information analysis and requirements-gathering work is completed accurately and to a high standard, including developing and socializing project artifacts. The role performs risk assessments and audit reviews, prepares findings and other reports, tracks outcomes, manages security-related plans and documentation, investigates suspicious network activity, and researches applicable security practices, standards, laws, and regulations. This is a four-month contract-to-hire position. Candidates must be eligible to convert to a full-time employee; visa sponsorship is unavailable. Candidates must be local to Phoenix within a maximum one-hour drive. State of Arizona remote work may be available, but work must be performed within Arizona unless an exception is authorized in advance.

Requirements

Knowledge of security principles, policies, procedures, and effective security policy development.
Knowledge of information security risk management.
Knowledge of cybersecurity and privacy laws, regulations, policies, principles, and ethics, including NIST 800-53 Revision 5, IRS Publication 1075, HIPAA/HITRUST, CJIS, and MARS-E.
Expert knowledge of internal auditing, internal controls, and risk management practices and methods.
Knowledge of selection and approval, implementation, and assessment or audit of security and privacy controls.
Knowledge of Risk Management Framework (RMF) requirements and authorization or approval of information systems.
Knowledge of conducting audits or reviews of technical systems and of internal control environments within IT.
Knowledge across technology domains, including aspects of Windows, Unix and/or database administration, software development, and networking.
Knowledge of cybersecurity and privacy issues arising from connections with internal and external customers and partner organizations.
Ability to produce high-quality work products for IT groups and senior management.
Excellent interpersonal, written, and oral communication skills.
Ability to assess, manage, and improve security policies and procedures.
Ability to work collaboratively across teams and organizations, synthesize feedback, adjust plans, build relationships, and manage large teams.
Ability to exercise judgment when policies are not well-defined and understand technology, management, leadership, and organizational problem-solving issues.
Ability to ensure information security management is integrated with strategic and operational planning.
Ability to develop policy, plans, and strategy in compliance with applicable laws, regulations, policies, and standards.

Responsibilities

Perform risk assessments and audit reviews; generate findings reports, recommend improvements, and track outcomes for DES reporting requirements.
Prepare comprehensive reports detailing findings, non-compliance, required Plans of Action and Milestones (POA&Ms), environmental observations, and incidents.
Review, update, and manage security-related audit plans, security plans, and risk-plan documentation for accuracy and consistency; proactively solve problems.
Evaluate data and report findings, areas of non-compliance, required action plans, and environmental observations.
Generate incident reports and investigate suspicious network activity.
Prepare audit documentation supporting audit results and draft and edit audit findings to meet applicable standards and agency writing style.
Research agency and industry IT security practices, standards, best practices, laws, regulations, and other applicable resources, and ensure compliance with standards.
Engage business units to understand reporting, data, and product needs; work across departments to define project requirements.
Identify data dependencies and relationships and develop logical and physical data models, data flows, and system activity diagrams.
Write specifications for managing enterprise information policies.
Develop plans and materials to support user adoption, training, and customer service.
Work directly with users from other divisions, programs, and service units to provide insight and guidance and help prioritize data-system enhancements.
Support technical project managers in completing information analysis and requirements gathering accurately and to a high standard.
Develop, maintain, and socialize key project artifacts.
Identify risks and suggest improvements to information systems and processes.
Develop policy, plans, and strategy in compliance with applicable laws, regulations, policies, and standards.
Promote the integration of information security practices throughout business and IT processes and their life cycles.