Senior IT Security Compliance Analyst

Stafford Gray•Lansing, MI

19h

About The Position

Stafford Gray is seeking a Senior IT Security Compliance Analyst for a contract role with a public-sector client in the Lansing area. The analyst will serve as the senior compliance lead for a portfolio of agency applications, owning System Security Plans (SSPs) and Disaster Recovery Plans, leading Authority to Operate (ATO) renewals, and coordinating among business partners, technical teams, security groups, auditors, and management. The role includes maintaining compliance documentation, managing ATO renewal activities on a three-year cycle, tracking remediation items, assessing security risks and incidents, coordinating incident response, and producing management reports and trend analyses. The analyst will also identify documentation gaps, guide remediation, and mentor team members while promoting consistent compliance processes across supported systems.

Requirements

At least 3 years of Governance, Risk & Compliance (GRC) experience.
At least 5 years providing audit evidence for security standards such as NIST, PCI, HIPAA, or FERPA.
Working knowledge of the NIST framework and controls.
At least 5 years of exposure to complex IT web applications within the past 5 years.
At least 5 years leading meetings and delivering written and oral reports.
At least 5 years working as a liaison between business and IT areas.
Bachelor’s degree in cybersecurity, information assurance, IT, or a related field, or 5 years of equivalent experience.
Strong documentation and communication skills.

Nice To Haves

At least 2 years creating supporting documentation for IT system audits.
At least 2 years creating Disaster Recovery, Business Continuity, and Incident Response plans.
Experience with Keylight or a comparable GRC platform, such as Archer, ServiceNow GRC, or LogicGate.
Advanced degree in cybersecurity, information assurance, or IT leadership, or an MBA with an IT or security concentration.
Security certification such as CISSP, CISM, CISA, or CRISC.

Responsibilities

Lead maintenance and updates of System Security Plans (SSPs) to ensure they are accurate, complete, and aligned with NIST controls and organizational compliance standards.
Plan and manage the ATO renewal process on a three-year cycle, including preparing materials, managing timelines, and ensuring security controls remain validated between renewals.
Track Plans of Action & Milestones (POA&Ms) and other compliance items through reporting and closure.
Review security risk assessment results, brief management, and recommend corrective actions.
Assess the risk and scope of high-level security incidents.
Lead mid- to high-level incident response from detection and correlation through response and recovery.
Create management reporting and trend analysis from security metrics across multiple business areas.
Review compliance documentation, identify gaps and risks, and guide remediation.
Coordinate with technical teams, business owners, enterprise security, vendors, auditors, and project leadership to keep SSP and ATO evidence and artifacts complete and current.
Mentor team members and promote consistent, standardized compliance processes across supported systems.