Senior IT Security Compliance Analyst

Stafford Gray • Lansing, MI

2h • $110,000

About The Position

Stafford Gray is seeking a Senior IT Security Compliance Analyst for a contract role with a public-sector client in the Lansing area. The analyst will serve as the senior compliance lead for a portfolio of agency applications, owning System Security Plans and Disaster Recovery Plans, leading Authority to Operate (ATO) renewals, and coordinating among business partners, technical teams, security groups, auditors, and management.

The role involves maintaining compliance documentation aligned with NIST controls and organizational standards; managing ATO renewals on a three-year cycle; tracking compliance actions through reporting and closure; reviewing risk assessments and recommending corrective actions; and assessing and leading responses to mid- to high-level security incidents. The analyst will also develop management reporting and trend analysis, identify documentation gaps and risks, coordinate evidence collection, mentor team members, and promote standardized compliance processes across supported systems.

Requirements

• At least 3 years of Governance, Risk & Compliance (GRC) experience.
• At least 5 years providing audit evidence for security standards such as NIST, PCI, HIPAA, or FERPA.
• Working knowledge of the NIST framework and controls.
• At least 5 years of exposure to complex IT web applications within the past 5 years.
• At least 5 years leading meetings and delivering written and oral reports.
• At least 5 years working as a liaison between business and IT areas.
• A bachelor’s degree in cybersecurity, information assurance, IT, or a related field, or 5 years of equivalent experience.
• Strong documentation and communication skills.

Nice To Haves

• At least 2 years creating supporting documentation for IT system audits.
• At least 2 years creating Disaster Recovery, Business Continuity, and Incident Response plans.
• Experience with Keylight or a comparable GRC platform, such as Archer, ServiceNow GRC, or LogicGate.
• An advanced degree in cybersecurity, information assurance, or IT leadership, or an MBA with an IT or security concentration.
• Security certifications such as CISSP, CISM, CISA, or CRISC.

Responsibilities

• Lead the maintenance and updating of System Security Plans (SSPs) to ensure accuracy, completeness, and alignment with NIST controls and organizational compliance standards.
• Plan and run ATO renewals on a three-year cycle, including preparing materials, managing timelines, and ensuring security controls remain validated between renewals.
• Work with stakeholders to track Plans of Action & Milestones (POA&Ms) and other compliance items through reporting and closure.
• Review security risk assessment results, brief management, and recommend corrective actions.
• Assess the risk and scope of high-level security incidents and lead mid- to high-level incident response from detection and correlation through response and recovery.
• Build management reporting and trend analysis from security metrics across multiple business areas.
• Review compliance documentation, identify gaps and risks, and guide corrective actions.
• Coordinate with technical teams, business owners, enterprise security, vendors, auditors, and project leadership to ensure SSP and ATO evidence and artifacts are complete and current.
• Mentor team members and promote consistent, standardized compliance processes across supported systems.

What This Job Offers

• Career Level: Senior