Security & Compliance Specialist

Leyden Solutions•Columbia, SC

10h

About The Position

The Security & Compliance Specialist supports the South Carolina Department of Probation, Parole, and Pardon Services (SCDPPPS), which supervises individuals on probation, parole, and other community-release programs and relies on custom, mission-critical applications while modernizing its Offender Management System (OMS). The role ensures alignment with applicable Criminal Justice Information Services (CJIS), South Carolina Department of Information Security (SC DIS), and Multi-Factor Authentication (MFA) requirements. It supports security modernization through the Transform Stream, security remediation and sustainment through the Run Stream, and elevated monitoring and response for High Profile Hearings involving the PIC and PAC applications. The Specialist works with application, infrastructure, database, program, and operational teams to identify, remediate, and prevent security risks. The position implements and improves identity and access management, authentication, authorization, role-based and least-privilege access, account lifecycle management, privileged-access controls, MFA, security logging, audit trails, log aggregation, retention, alerting, and analysis. It reviews technical changes and releases for security impacts, translates compliance requirements into controls and implementation plans, and supports assessments, audits, authorization activities, and oversight inquiries. The Specialist manages vulnerability and dependency remediation across PIC, PAC, OMS, IIMS, and other assigned applications. Work includes assessing vulnerable or unsupported components, coordinating upgrades and other corrective measures, validating that remediation preserves system functionality and required controls, and tracking risks, exceptions, decisions, and closure evidence. The position also provides operational monitoring and incident support during designated High Profile Hearings, maintains security documentation and compliance artifacts, and communicates security risks and remediation priorities to technical and nontechnical stakeholders. This is a part-time role requiring an estimated 75–80 hours per month. Work may be remote, on-site, or hybrid, subject to program, customer, and security requirements. Occasional work outside standard business hours may be required for maintenance, releases, security incidents, vulnerability remediation, or High Profile Hearings. The incumbent may access sensitive, controlled, proprietary, or criminal justice information and must comply with applicable privacy, data-handling, personnel-screening, security-training, and acceptable-use requirements.

Requirements

Bachelor’s degree in cybersecurity, information assurance, information technology, computer science, or a related discipline; comparable experience, technical training, or certifications may be substituted.
Experience supporting information security, cybersecurity compliance, security engineering, or security operations in a complex enterprise environment.
Knowledge of CJIS-aligned security principles and criminal justice information protection requirements.
Experience with IAM, role-based access control, authentication and authorization workflows, MFA, and least-privilege practices.
Experience with vulnerability identification, dependency management, patching, remediation tracking, and corrective-action validation.
Experience with security logging, audit trails, log aggregation, security monitoring, alerting, and incident-response support.
Knowledge of secure application-development practices, common software vulnerabilities, software supply-chain risk, and security-testing approaches.
Ability to assess technical risk, develop practical remediation recommendations, coordinate cross-functional resolution, and prepare clear security documentation.
Ability to manage priorities and provide reliable support within an estimated commitment of 75–80 hours per month.
Comply with applicable privacy, data-handling, personnel-screening, security-training, and acceptable-use requirements when accessing sensitive, controlled, proprietary, or criminal justice information.

Nice To Haves

Certifications such as CISSP, CISM, CISA, Security+, GIAC, CCSP, CEH, Microsoft security certifications, or equivalent credentials.
Experience supporting state or local government, courts, law enforcement, public safety, or criminal justice organizations.
Experience with SIEM, security orchestration and response, endpoint security, vulnerability scanning, and identity-governance tools.
Experience with cloud and hybrid security, Zero Trust principles, and secure API or microservices architectures.
Familiarity with NIST-based risk-management frameworks, security-control assessments, secure configuration benchmarks, and authorization processes.
Experience supporting high-visibility operational events, incident-response exercises, continuity-of-operations activities, or elevated monitoring periods.

Responsibilities

Ensure application development, system configuration, infrastructure changes, integrations, operational processes, and documentation comply with applicable CJIS, SC DIS, and MFA security-control requirements.
Translate security and compliance requirements into technical controls, implementation tasks, validation criteria, and remediation plans.
Review releases, enhancements, configuration changes, and technical solutions for security and compliance impacts before deployment.
Identify control gaps, prioritize corrective actions, track remediation through completion, and maintain supporting evidence.
Support security assessments, audits, authorization activities, compliance reviews, and responses to oversight inquiries.
Implement security modernization initiatives across the Transform Stream.
Design, configure, and improve IAM capabilities, including authentication, authorization, role-based access control, least-privilege access, account lifecycle management, and privileged-access controls.
Implement and maintain MFA and modern authentication patterns across assigned applications, infrastructure, service accounts, APIs, and administrative interfaces.
Implement and enhance security logging, audit trails, log aggregation, retention, alerting, and analysis; establish logging standards for security-relevant activity and anomalous behavior.
Coordinate with application and infrastructure teams to integrate security capabilities into architecture, development, testing, deployment, and operations.
Identify, prioritize, remediate, and validate vulnerable, unsupported, deprecated, or end-of-life libraries and dependencies in assigned Run Stream backlog items.
Review technology stacks supporting PIC, PAC, OMS, IIMS, and other assigned applications to assess vulnerable components and their security, compliance, and operational impacts.
Coordinate secure upgrades, dependency replacements, refactoring, configuration changes, patching, and compensating controls.
Validate that remediation preserves system functionality, interoperability, performance, availability, and required security controls.
Track vulnerabilities, remediation progress, exceptions, risk-acceptance decisions, and closure evidence in accordance with program procedures.
Recommend remediation priorities based on severity, exploitability, exposure, business criticality, compliance obligations, and operational impact.
Provide security-focused operational support and enhanced monitoring during High Profile Hearings involving PIC and PAC.
Monitor application availability, access activity, audit logs, authentication events, performance indicators, and security alerts during designated hearing periods.
Identify, investigate, document, escalate, and coordinate response to suspicious activity, access-control issues, security events, service disruptions, and operational risks.
Participate in pre-hearing readiness activities, including access reviews, control verification, logging validation, contingency planning, and stakeholder coordination.
Maintain event records, monitoring logs, incident documentation, and post-event observations; recommend improvements to resilience, monitoring, security posture, and incident-response readiness.
Improve security monitoring, alerting, incident-response, vulnerability-management, access-review, and change-control processes.
Support secure software-development lifecycle activities, including security requirements, architecture reviews, code and dependency reviews, security testing, release validation, and production monitoring.
Develop and maintain control matrices, risk registers, architecture documentation, operating procedures, remediation plans, monitoring runbooks, and compliance evidence.
Collaborate with technical teams to maintain secure configuration baselines, patch-management practices, encryption, secure communications, and audit logging.
Communicate security risks, compliance findings, remediation priorities, and operational impacts clearly to technical and nontechnical stakeholders.