16332 - IT Security Analyst 3

Smith Johnson Tech•Lansing, MI

2d•Hybrid

About The Position

This senior IT business/compliance analyst serves as a resource within the Department of Technology, Management and Budget (DTMB) Agency Services for the Michigan Department of Civil Rights (MDCR), Michigan Civil Service Commission (MCSC), and Michigan Department of Lifelong Education, Advancement and Potential (MiLEAP). The role provides oversight, guidance, and strategic direction for completing, updating, and maintaining System Security Plans (SSPs) and Disaster Recovery Plans (DRPs) for MCSC and MiLEAP applications. The analyst acts as a compliance authority and liaison among business partners, technical teams, security groups, and management, ensuring requirements, processes, and documentation align with State of Michigan standards, NIST protocols, and enterprise security governance. The position also collaborates with vendors, auditors, project managers, and analysts outside the DTMB Agency Services Compliance Team. The role leads and coordinates Authority to Operate (ATO) renewals, maintains application security documentation and controls, and supports compliance across multiple agencies. It also reviews security risks and incidents, develops management reports and trend analyses, and guides stakeholders through compliance requirements, remediation, and incident response.

Requirements

At least 3 years of Governance, Risk and Compliance (GRC) experience.
At least 5 years providing audit evidence to comply with security standards such as NIST, PCI, HIPAA, or FERPA.
At least 5 years of exposure to complex IT web applications within the past 5 years.
Educational or professional knowledge of the NIST Framework and controls.
At least 5 years of experience working as a liaison between business and IT areas.
Knowledge or experience creating supporting documentation for IT system audits.
Experience creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans.
At least 5 years of experience leading meetings and making oral and written reports.

Nice To Haves

Bachelor’s degree in cybersecurity, Information Assurance, Business Analytics, or an IT-related field is preferred.
Advanced degree preferred, such as a master’s in Cybersecurity, Information Assurance, Information Systems/IT Leadership, or an MBA with an IT or Security concentration.

Responsibilities

Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring accuracy, completeness, and alignment with NIST protocols and State of Michigan compliance standards.
Lead and coordinate Authority to Operate (ATO) renewals, including planning, preparing materials, managing timelines, and supporting approval and continuous compliance.
Ensure applications maintain a valid ATO on a three-year cycle and validate and maintain security controls throughout renewal periods.
Review security risk assessment results, inform management, and recommend corrective actions as needed.
Review and assess risks and scope for high-level security incidents; develop management reports and conduct trend analysis using metrics collected across multiple agencies.
Work with stakeholders to address and track Plans of Action & Milestones (POA&Ms) and other compliance requirements, ensuring timely reporting and closure.
Provide senior-level support across MDCR, MCSC, and MiLEAP, focusing on standardized security plan updates, documentation improvements, and process consistency.
Analyze compliance documentation, identify gaps or risks, and guide corrective actions to meet regulatory and organizational requirements.
Coordinate with technical teams, business owners, enterprise security personnel, and project leadership to ensure required SSP and ATO evidence and artifacts are completed and maintained.
Oversee review, updates, and remediation of security controls, ensuring issues are tracked, communicated, and resolved with stakeholders.
Identify procedural gaps, risks, and required updates during renewal cycles and promote consistent use of best practices across supported systems.
Contribute to enterprise security governance by providing guidance, maintaining records, mentoring team members, and driving timely completion of compliance activities.
Lead mid- to high-level incident responses and serve as an incident response specialist for cyber event detection, correlation, response, and recovery.