IT Security & Compliance Specialist I - EHRA

State of North Carolina•Wake Forest, NC

1d•$75,818 - $113,727•Hybrid

About The Position

The IT Security & Compliance Specialist I supports the Department of Environmental Quality’s information security, risk management, and regulatory compliance programs. This is entry-level professional work performed under general supervision and established procedures and guidelines. The position assists with security control monitoring, compliance documentation, audit support, and risk tracking in accordance with State of North Carolina IT security policies, standards, and frameworks. The position supports the implementation and maintenance of security controls across agency systems; monitors security tools, alerts, and reports to identify threats, mitigate risks, and escalate incidents; and assists with vulnerability management, security configuration reviews, access control monitoring, and administration of firewalls, VPNs, web application firewalls, and other security technologies. The specialist supports compliance with state and federal requirements and frameworks, including NIST, CIS, HIPAA, and the NC Statewide Information Security Manual. Duties include maintaining security documentation, policies, procedures, and system security plans; assisting with risk assessments, control evaluations, audits, and remediation tracking; supporting internal and external audits; documenting findings and tracking corrective actions; and assisting with security awareness initiatives, training, and user guidance. The role also collaborates with IT teams, business units, and external stakeholders and prepares reports, metrics, and status updates for leadership and security management. The position may be eligible for hybrid remote work under state policy and the agency’s remote work program, but requires weekly onsite work. Telework is subject to the state Teleworking Program Policy and may be ended by the employer at its discretion. The position is designated Statutory Exempt (EHRA) and is exempt from the State Human Resources Act. Salary range: $75,818–$113,727.

Requirements

Bachelor’s degree in Computer Science or a related IT or closely related field from an appropriately accredited institution and one year of experience in IT Security; or an associate degree in Computer Science or a related IT or closely related field from an appropriately accredited institution and two years of experience in IT Security; or an equivalent combination of education and experience.

Nice To Haves

Foundational knowledge of information security principles, best practices, and terminology, with an interest in applying that knowledge.
Familiarity with security and compliance frameworks, including the NIST 800-series, CIS Controls, HIPAA, and State IT security standards.
Ability to review and interpret policies, procedures, and technical documentation and translate them into practical understanding.

Responsibilities

Support implementation and maintenance of security controls across agency systems.
Monitor security tools, alerts, and reports to identify threats, mitigate risks, and escalate incidents as needed.
Assist with vulnerability management, security configuration reviews, and access control monitoring.
Support administration of firewalls, VPNs, web application firewalls (WAFs), and other security technologies.
Support compliance with state and federal security requirements and frameworks, including NIST, CIS, HIPAA, and the NC Statewide Information Security Manual.
Maintain security documentation, policies, procedures, and system security plans.
Assist with risk assessments, control evaluations, audits, and remediation tracking.
Gather documentation and respond to information requests in support of internal and external audits.
Assist with annual risk assessments, security reviews, and validation of security controls.
Document findings and track corrective actions to completion.
Support security awareness initiatives, training programs, and user guidance.
Develop and maintain security documentation, job aids, and process materials.
Partner with IT teams, business units, and external stakeholders to support security and compliance objectives.
Prepare reports, metrics, and status updates on security, risk, compliance, and remediation activities.
Communicate risks, issues, and progress to leadership and security management.