Security Analyst - MiLEAP, MCSC

Zenfreed•Lansing, MI

1d•Hybrid

About The Position

This Senior IT Business/Compliance Analyst role supports the Department of Technology, Management and Budget (DTMB) Agency Services for the Michigan Department of Civil Rights (MDCR), Michigan Civil Service Commission (MCSC), and Michigan Department of Lifelong Education, Advancement and Potential (MiLEAP). The role provides senior-level oversight, guidance, and strategic direction for System Security Plans (SSPs) and Disaster Recovery Plans (DRPs) for MCSC and MiLEAP applications. It serves as a compliance authority and liaison among business partners, technical teams, security groups, management, vendors, auditors, project managers, and analysts. The position ensures requirements, processes, and documentation align with State of Michigan standards, NIST protocols, and enterprise security governance. The analyst leads Authority to Operate (ATO) renewal activities, maintains application compliance on a three-year renewal cycle, supports risk assessment and incident response, tracks Plans of Action & Milestones (POA&Ms), and drives consistency in security documentation and processes across supported applications and agencies. This is a W2 position for 40 hours per week on a hybrid schedule, with no remote-only option. The employee must be onsite two days per week from the first day. Work hours are approximately Monday through Friday, 8:00 a.m. to 5:00 p.m. Candidates must be located within 90 miles of Lansing, Michigan at the time of submission. Applicants must be authorized to work in the United States; sponsorship is unavailable. Employment requires a background check and drug screening.

Requirements

Five years of experience providing audit evidence to comply with security standards such as NIST, PCI, HIPAA, or FERPA.
Recent exposure to complex IT web applications within the past five years.
Experience leading meetings and preparing oral and written reports.
Experience serving as a liaison between business and IT areas.
A bachelor's degree in cybersecurity, information assurance, business analytics, or a related IT field, or five years of experience.
Knowledge of the NIST Framework and controls.
Strong written and oral communication skills.
Strong documentation skills.
Ability to collaborate cross-functionally.
Authorization to work in the United States; sponsorship is not available.
Must complete a background check and drug screening.
Must be located within 90 miles of Lansing, Michigan at the time of submission.

Nice To Haves

Advanced degree, such as a master's in cybersecurity, information assurance, information systems, or IT leadership, or an MBA with an IT or security concentration.
Two years of knowledge or experience creating supporting documentation for IT system audits.
Experience creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans.
One to three years of Keylight experience.

Responsibilities

Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring accuracy, completeness, and alignment with NIST protocols and State of Michigan compliance standards.
Lead and coordinate Authority to Operate (ATO) renewals, including planning, preparing materials, managing timelines, and securing approvals.
Maintain valid ATOs for supported applications on a three-year cycle and validate security controls throughout each renewal period.
Review security risk assessment results, inform management, and recommend corrective actions.
Assess risks and scope for high-level security incidents.
Develop management reports and conduct trend analysis using metrics collected across multiple agencies.
Work with stakeholders to address and track POA&Ms and other compliance requirements, ensuring timely reporting and closure.
Provide senior-level support across MDCR, MCSC, and MiLEAP, standardizing security plan updates and improving documentation and long-term process consistency.
Analyze compliance documentation, identify gaps or risks, and guide corrective actions to meet regulatory and organizational requirements.
Coordinate cross-functional work with technical teams, business owners, enterprise security personnel, and project leadership to complete and maintain evidence and artifacts for SSP and ATO processes.
Oversee security control reviews, updates, and remediation; ensure issues are tracked, communicated, and resolved with stakeholders.
Identify procedural gaps, risks, and required updates during renewal cycles and encourage consistent application of best practices.
Contribute to enterprise security governance by providing guidance, maintaining records, mentoring team members, and driving timely completion of compliance activities.
Lead mid- to high-level incident responses and serve as an incident response specialist for cyber event detection, correlation, response, and recovery.