Network Security Analyst

Lumen Solutions Group Inc.•Austin, TX

5d•Hybrid

About The Position

The Network Security Analyst II – System Security & Risk (GRC) Specialist will support enterprise cybersecurity Governance, Risk, and Compliance (GRC) operations for the Texas Health and Human Services Commission (HHSC) Office of the Chief Information Security Officer (CISO). This role involves supporting System Security Plan (SSP) development, Security Assessments (SA), and Risk Assessments (RA) across HHSC and DSHS application and infrastructure portfolios. The analyst will collaborate with program areas, Information Owners, Information Custodians, technical teams, and the CISO Office to ensure security documentation, assessments, and risk records are completed in accordance with NIST SP 800-53, NIST Risk Management Framework (RMF), DIR Security Control Standards, and HHSC CISO Office procedures. RSA Archer GRC is used as the system of record for these activities.

Requirements

4+ years of experience in cybersecurity GRC, system security planning, or information assurance.
Hands-on experience developing System Security Plans (SSPs), conducting Security Assessments, and facilitating Risk Assessments.
Knowledge of NIST SP 800-53 and NIST Risk Management Framework.
Experience using GRC platforms (RSA Archer preferred).
Experience working with Information Owners and Custodians.
Strong technical writing and documentation skills.
Ability to work independently on complex assignments.
Must pass background check.
Must comply with HHSC confidentiality and security requirements.

Nice To Haves

Experience in state or federal government cybersecurity programs.
Familiarity with DIR Security Control Standards.
Experience supporting ATO and continuous monitoring.
CRISC or CISA certification.

Responsibilities

Develop, update, and maintain System Security Plans for HHSC applications and systems.
Work with program teams, Information Owners, and Custodians to gather control implementation evidence.
Ensure System Security Plans align with NIST, DIR, and HHSC CISO Office standards.
Plan and conduct Security Assessments to validate implementation and effectiveness of security controls.
Review technical, administrative, and operational evidence.
Document assessment results and track remediation activities.
Facilitate Risk Assessment workshops with Information Owners and Custodians.
Identify threats, vulnerabilities, likelihood, and impact.
Document risks, mitigation plans, and Risk-Based Decisions in RSA Archer.
Maintain security artifacts, risks, and remediation plans in RSA Archer GRC.
Support system authorization (ATO) activities and continuous monitoring.
Prepare audit and oversight evidence.
Produce leadership reports and security posture metrics.
Serve as liaison between program areas, technical teams, and CISO Office leadership.
Provide guidance and training on System Security Plans, Security Assessments, and Risk Assessment processes.