Security and Governance Analyst

Michigan Virtual•Lansing, MI

2d•Hybrid

About The Position

The Security and Governance Analyst works within Technology Operations to maintain Michigan Virtual’s systems and data and ensure technology—including AI and automation—is adopted securely, responsibly, and in compliance with organizational standards. The role combines day-to-day security operations with AI governance review, serving as a checkpoint for AI and automated solutions before release and throughout their lifecycle. The analyst works with the AI, Automation, & Governance Manager, the AI & Automation Specialist, the Managed Service Provider, and teams across the organization to keep security and governance practical and well-documented. Responsibilities span security monitoring and analysis, incident response, vulnerability management, compliance, AI request review, and governance support. The analyst assesses risks, reviews and documents findings, supports corrective actions, maintains records and inventories, and communicates security and compliance matters to technical and non-technical stakeholders. The role also contributes to staff training, security procedures, and ongoing professional development. Michigan Virtual is a Lansing-based nonprofit 501(c)(3) organization focused on advancing education through research, innovation, policy, and digital learning solutions. It serves more than 300 full- and part-time employees. The organization describes its culture as collaborative and caring, with an emphasis on professional growth and continuous learning. The position is hybrid under Michigan Virtual policy, and Michigan residents receive hiring preference. The organization plans to begin the hiring process after the posting closes in mid-November and anticipates a start date in early January.

Requirements

Hands-on experience in security operations, such as monitoring, log analysis, vulnerability management, and incident response.
Working knowledge of security frameworks and controls, such as CIS Controls or NIST.
Experience conducting risk, vendor, or compliance reviews and documenting findings and decisions.
Working knowledge of data privacy, FERPA, and responsible use of technology, including risks of AI tools.
Familiarity with identity and access management concepts, such as role-based access, single sign-on, and least privilege.
Strong judgment and the ability to balance security and compliance with the needs of supported teams.
Clear written and verbal communication, including the ability to explain security and compliance topics to non-technical audiences.
Ability to manage competing priorities.
Bachelor’s degree in information technology, cybersecurity, computer science, or a related field, or equivalent experience.
Three or more years of experience in information security, IT compliance, risk, or a related field.
Security certification such as Security+, CySA+, CCST, or similar is required.

Nice To Haves

Experience with Microsoft 365, Entra ID, and endpoint management tools.

Responsibilities

Monitor and advise on information security issues affecting internal systems and workflows, ensuring appropriate security controls are in place.
Review and analyze IDS, firewall, identity, and cloud-service logs to identify threats and vulnerabilities, and implement corrective actions.
Conduct security assessments of systems, workflows, and applications, and stay current on security issues, emerging threats, best practices, and trends.
Support incident investigation, containment, documentation, resolution, and post-incident review.
Work with the Managed Service Provider to identify, triage, and escalate security incidents; review alerts and monitoring data, determine severity and scope, and coordinate response actions.
Maintain incident records and lessons learned, and recommend improvements to response procedures.
Provide technical support for security-related issues raised by end users.
Perform vulnerability assessments, coordinate patching, removals, and updates with the Managed Service Provider and IT teams, and track corrective actions to completion.
Support implementation and maintenance of CIS Controls and other security initiatives.
Conduct scheduled audits to maintain compliance with security policies, and document findings and remediation.
Triage AI and automation requests, including assessing risks related to data sensitivity, system access, and impact.
Conduct security, privacy, and vendor reviews of tools, automations, and new applications before adoption and periodically afterward, including review of data handling, access and permissions, vendor security, and FERPA and data privacy obligations.
Review AI and automation solutions before production release and verify that access controls and logging are in place.
Help build and maintain the AI tool and automation inventory and supporting review records, including purpose, data sources, owners, vendors, risk assessments, and review dates.
Support the development and maintenance of AI governance policies, standards, and review procedures, and report on compliance, exceptions, and risks.
Conduct user security training using existing training tools and contribute AI security and responsible-use guidance to staff training with the AI, Automation & Governance team.
Collaborate with the Managed Service Provider, leadership, and other teams to implement and uphold security practices and standards.
Communicate security risks, review outcomes, and compliance status to the Manager and stakeholders.
Maintain documentation of security systems and procedures, including security-related knowledge base articles.
Use Wrike to manage tasks, projects, and recurring security and review processes.
Complete professional development opportunities that strengthen skills and benefit Michigan Virtual.