Senior IT Security Compliance Analyst

MasterApp Labs•Lansing, MI

8h•Hybrid

About The Position

The Senior IT Security Compliance Analyst provides senior-level leadership and oversight for security compliance across supported applications and multiple business areas, including MDCR, MCSC, and MiLEAP. The role maintains and updates System Security Plans (SSPs), coordinates Authority to Operate (ATO) renewals, validates security controls, and supports continuous compliance with NIST protocols and State of Michigan (SOM) standards. Applications must maintain a valid ATO on a three-year cycle. The analyst reviews security risk assessments and incidents, recommends corrective actions, develops management reports from security metrics, and conducts trend analysis across multiple agencies. The role coordinates with technical teams, business owners, enterprise security personnel, and project leadership to maintain required compliance evidence and artifacts; tracks Plans of Action & Milestones (POA&Ms); and identifies documentation gaps, procedural risks, and control remediation needs. The analyst also contributes to enterprise security governance, maintains accurate records, mentors team members, and leads mid- to high-level incident response activities, including cyber event detection, correlation, response, and recovery. This is a contract position based in Lansing, Michigan. The arrangement is hybrid, with onsite work two days per week from the first day. The posting also notes flexible work-from-home options. Interviews are conducted first via MS Teams and then in person.

Requirements

Bachelor’s degree in cybersecurity, information assurance, business analytics, or an IT-related field, or five years of experience.
Educational or professional knowledge of the NIST Framework and controls.
Strong written and oral communication skills.
Strong documentation skills.
Ability to collaborate cross-functionally.
At least 3 years of Governance, Risk and Compliance (GRC) experience.
At least 5 years of experience providing audit evidence to comply with security standards such as NIST, PCI, HIPAA, or FERPA.
At least 5 years of exposure to complex IT web applications within the past 5 years.
At least 5 years of experience leading meetings and preparing oral and written reports.
At least 5 years of experience serving as a liaison between business and IT areas.

Nice To Haves

Advanced degree, preferably a master’s in cybersecurity, information assurance, information systems or IT leadership, or an MBA with an IT or security concentration.
At least 2 years of experience creating supporting documentation for IT system audits.
At least 2 years of experience creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans.
Keylight experience is strongly desired; 1–3+ years listed.

Responsibilities

Provide leadership and oversight for maintaining and updating SSPs, ensuring accuracy, completeness, and alignment with NIST protocols and SOM compliance standards.
Lead and coordinate ATO renewal planning, preparation of required materials, timeline management, and approval processes for supported applications.
Ensure applications maintain a valid ATO on a three-year cycle and validate security controls throughout renewal periods.
Review security risk assessment results, inform management, and recommend corrective actions.
Assess risks and scope for high-level security incidents; develop management reports from metrics collected across multiple agencies and conduct trend analysis.
Work with stakeholders to address and track POA&Ms and other compliance requirements, ensuring timely reporting and closure.
Provide senior-level compliance support across MDCR, MCSC, and MiLEAP, focusing on standardized security plan updates, documentation improvements, and consistent processes.
Analyze compliance documentation, identify gaps or risks, and guide corrective actions to meet regulatory and organizational requirements.
Coordinate with technical teams, business owners, enterprise security personnel, and project leadership to complete and maintain SSP and ATO evidence and artifacts.
Oversee the review, updating, and remediation of security controls, ensuring issues are tracked, communicated, and resolved with stakeholders.
Identify procedural gaps, risks, and required updates during renewal cycles and promote consistent application of best practices across supported systems.
Contribute to enterprise security governance by providing guidance, maintaining accurate records, mentoring team members, and driving timely completion of compliance activities.
Lead mid- to high-level incident responses to resolve incidents.
Serve as an incident response specialist for cyber event detection, correlation, response, and recovery.