IT Security Analyst

Novalink Solutions LLC•Lansing, MI

21h

About The Position

This senior-level IT Business/Compliance Analyst role serves the Department of Technology, Management and Budget (DTMB) Agency Services for the Michigan Department of Civil Rights (MDCR), Michigan Civil Service Commission (MCSC), and Michigan Department of Lifelong Education, Advancement and Potential (MiLEAP). The position provides oversight, guidance, and strategic direction for completing, updating, and maintaining System Security Plans (SSPs) and Disaster Recovery Plans (DRPs) for MCSC and MiLEAP applications. The role serves as the compliance authority and liaison among business partners, technical teams, security groups, and management. It ensures requirements, processes, and documentation align with State of Michigan standards, NIST protocols, and enterprise security governance. The analyst guides stakeholders through compliance cycles, promotes consistency across application areas, and collaborates with vendors, auditors, project managers, and analysts outside the DTMB Agency Services Compliance Team. The position also supports security governance and mid- to high-level incident response, including cyber event detection, correlation, response, and recovery.

Requirements

At least 3 years of Governance, Risk and Compliance (GRC) experience.
At least 5 years of experience providing audit evidence to comply with security standards such as NIST, PCI, HIPAA, or FERPA.
At least 5 years of exposure to complex IT web applications within the past 5 years.
At least 5 years of experience leading meetings and preparing oral and written reports.
At least 5 years of experience serving as a liaison between business and IT areas.
Bachelor’s degree in cybersecurity, Information Assurance, Business Analytics, or an IT-related field, or 5 years of experience.
Educational or professional knowledge of the NIST Framework and controls.
Strong written and oral communication skills.
Strong documentation skills.
Ability to collaborate cross-functionally.

Nice To Haves

Master’s degree in Cybersecurity, Information Assurance, Information Systems, IT Leadership, or an MBA with an IT or Security concentration.
At least 2 years of knowledge or experience creating supporting documentation for IT system audits.
At least 2 years of experience creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans.
Keylight experience is strongly desired.

Responsibilities

Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring accuracy, completeness, and alignment with NIST protocols and State of Michigan compliance standards.
Lead and coordinate Authority to Operate (ATO) renewals, including planning, preparing materials, managing timelines, and supporting approval and continuous compliance for supported applications.
Ensure applications maintain a valid ATO on a three-year cycle and validate and maintain security controls throughout renewal periods.
Review security risk assessment results, inform management, and recommend corrective actions.
Review and assess risks and scope for high-level security incidents; develop management reports from metrics gathered across multiple agencies and conduct trend analysis.
Work with stakeholders to address and track Plans of Action & Milestones (POA&Ms) and other compliance requirements, ensuring timely reporting and closure.
Provide senior-level support across MDCR, MCSC, and MiLEAP, focusing on standardized security plan updates, documentation improvements, and consistent long-term processes.
Analyze compliance documentation, identify gaps or risks, and guide corrective actions to meet regulatory and organizational requirements.
Coordinate with technical teams, business owners, enterprise security personnel, and project leadership to complete and maintain evidence and artifacts for SSP and ATO processes.
Oversee review, updates, and remediation of security controls; ensure issues are tracked, communicated, and resolved with stakeholders.
Identify procedural gaps, risks, and required updates during renewal cycles and promote consistent best practices across supported systems.
Contribute to enterprise security governance by providing guidance, maintaining accurate records, mentoring team members, and driving timely completion of compliance activities.
Lead mid- to high-level incident response efforts to resolve incidents.
Serve as an incident response specialist for cyber event detection, correlation, response, and recovery.