Security Analyst

KēSTA I.T.•Lansing, MI

About The Position

KēSTA I.T. is seeking a Senior IT Security and Compliance Analyst to serve as a senior resource and compliance authority for a public-sector technology organization. The role supports multiple agency business areas and focuses on System Security Plans (SSPs), Disaster Recovery Plans (DRPs), and Authority to Operate (ATO) renewals. The analyst serves as a liaison among business partners, technical teams, security groups, and management, ensuring requirements, processes, and documentation align with state standards, NIST protocols, and enterprise security governance. The role guides stakeholders through complex compliance cycles and promotes consistency across application areas, while also collaborating with vendors, auditors, project managers, and other analysts. The position also serves as an incident response specialist, leading mid- to high-level incident responses and contributing to cyber event detection, correlation, response, and recovery. Success includes keeping security documentation current and accurate, maintaining valid ATOs on a three-year cycle, tracking and closing remediation items, and providing management with clear risk reporting.

Requirements

Bachelor's degree in cybersecurity, Information Assurance, Business Analytics, or an IT-related field, or 5 years of experience.
At least 3 years of Governance, Risk and Compliance (GRC) experience.
5 years of experience providing audit evidence to comply with security standards such as NIST, PCI, HIPPA, and FERPA.
5 years of exposure to complex IT web applications within the past 5 years.
5 years of experience leading meetings and making oral and written reports.
5 years of experience working as a liaison between different business and IT areas.
Educational or professional knowledge of the NIST Framework and Controls.
Strong written and oral communication skills.
Strong documentation skills.
Ability to collaborate cross-functionally.

Nice To Haves

Master's degree in Cybersecurity, Information Assurance, Information Systems / IT Leadership, or an MBA with an IT or Security concentration.
Keylight experience (highly desired, 1–3+ years).
Knowledge or experience creating supporting documentation for IT system audits (highly desired, 2 years).
Experience creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans (highly desired, 2 years).

Responsibilities

Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring accuracy, completeness, and alignment with NIST protocol and state compliance standards.
Lead and coordinate the Authority to Operate (ATO) renewal process, including planning, preparing required materials, managing timelines, and securing approval for supported applications.
Ensure applications maintain valid ATOs on a three-year cycle and validate and maintain accurate security controls throughout each renewal period.
Review security risk assessment results, inform management, and recommend corrective actions as needed.
Review and assess risk and scope for high-level security incidents, and develop management reports from collected metrics across multiple agencies, including trend analysis.
Lead mid- to high-level incident responses and serve as an incident response specialist for cyber event detection, correlation, response, and recovery.
Work with stakeholders to address and track Plans of Action and Milestones (POA&Ms) and other compliance requirements, ensuring timely reporting and closure.
Provide senior-level support across multiple business areas, focusing on standardized security plan updates, documentation improvements, and long-term process consistency.
Analyze compliance documentation, identify gaps and risks, and guide corrective actions to meet regulatory and organizational requirements.
Coordinate collaboration among technical teams, business owners, enterprise security personnel, and project leadership to ensure SSP and ATO evidence and artifacts are complete and maintained.
Oversee review, updates, and remediation of security controls, ensuring issues are tracked, communicated, and resolved with stakeholders.
Identify procedural gaps, risks, or needed updates during renewal cycles and promote consistent application of best practices across supported systems.
Contribute to enterprise security governance by providing guidance, maintaining accurate records, mentoring team members, and driving timely completion of compliance activities.
Collaborate with vendors, auditors, project managers, and analysts outside the core compliance team.