SLED Security Analyst, Information Security

Presidio•,

About The Position

This position is responsible for managing and maintaining all documentation, governance activities, compliance initiatives, and operational processes necessary to attain and maintain security authorizations and certifications supporting State, Local, Education, and Government (SLED) customers. The individual will possess strong knowledge of NIST-based security frameworks, including NIST SP 800-53 Moderate, FedRAMP, GovRAMP, StateRAMP, CJIS Security Policy, NIST Cybersecurity Framework (CSF), NIST SP 800-171, HIPAA, and related regulatory requirements. The individual will be experienced in information security governance, risk management, compliance, authorization package development, audit readiness, security documentation, incident response planning, business continuity planning, and continuous monitoring activities. The position requires strong technical writing skills, the ability to analyze risk, develop policies and procedures, coordinate with technical and business stakeholders, and support enterprise-wide compliance initiatives.

Requirements

Associate degree (preferably in Computer Science, Cybersecurity, Information Systems, Information Security, or related field from an accredited college or university) or the equivalent work experience and/or military experience
3+ years of experience supporting information security, governance, risk, compliance, audit, or authorization programs.
One or more security certifications such as Security+, CISSP, CISA, CGRC (CAP), CRISC, CASP+, CCSP, GIAC, CSA, or equivalent.
Experience supporting NIST SP 800-53 Moderate, FedRAMP, GovRAMP, StateRAMP, CJIS Security Policy, NIST Cybersecurity Framework (CSF), NIST SP 800-171, HIPAA, or other SLED-related compliance programs.
Experience developing and maintaining System Security Plans (SSP), POA&M documentation, security policies, standards, procedures, and authorization artifacts.
Intermediate to advanced technical writing skills with demonstrated experience producing compliance and governance documentation.
Experience supporting independent assessments, audits, reviews, and authorization activities.
Experience with governance, risk, and compliance platforms including Vanta, Drata, Archer, ServiceNow, or similar technologies.
Understanding of technical concepts and security technologies including cloud computing, identity and access management, VPNs, firewalls, web application firewalls, vulnerability management, endpoint protection, logging, monitoring, and network security controls.
Skills in project prioritization, issue management, remediation tracking, risk assessment, and problem resolution.
Exceptional writing skills combined with strong presentation and communication skills.
Expert analytical thinking skills, including the ability to summarize information and clearly identify risks, findings, trends, and remediation requirements.
Experience creating, generating, maintaining, and reporting on compliance metrics, audit evidence, control documentation, and security reporting.
Experience utilizing artificial intelligence tools and technologies to improve documentation, compliance operations, and security processes.
Ability to manage multiple projects, priorities, audits, and compliance initiatives simultaneously.
Ability to communicate and translate security risks to technical and non-technical audiences.
Ability to analyze complex security and compliance issues and develop practical solutions.

Nice To Haves

Experience working with cloud service providers including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
Customer service skills and client focus.
Strong communication skills, including the ability to communicate technical information in non-technical language.
Strong time management and organizational skills.
Strong problem-solving and analytical skills.
Excellent interpersonal skills.
Comprehensive verbal and written communication skills.
Ability to remain calm and effective during audits, assessments, security incidents, and periods of increased workload.
Ability to work on multiple projects simultaneously.
Ability to work effectively with stakeholders across all organizational levels.
Experience working with public-sector, education, healthcare, or regulated industry customers.

Responsibilities

Leads the development and maintenance of security architecture, governance frameworks, policies, standards, procedures, and control implementation guidance.
Supports security authorization initiatives aligned to NIST SP 800-53 Moderate, FedRAMP Moderate, GovRAMP, StateRAMP, CJIS Security Policy, HIPAA, NIST SP 800-171, and related regulatory frameworks.
Assembles, develops, maintains, and updates System Security Plans (SSP), supporting documentation, and authorization package artifacts.
Maps implemented security control requirements to NIST SP 800-53 Moderate baselines, CJIS Security Policy, FedRAMP, GovRAMP, and other applicable control overlays.
Documents implemented, inherited, hybrid, and customer-responsibility controls within authorization packages.
Collects, validates, organizes, and maintains technical, administrative, and procedural evidence supporting compliance and assessment activities.
Establishes and maintains centralized control evidence repositories utilizing governance and compliance management platforms such as Vanta or equivalent technologies.
Supports independent assessors, auditors, regulators, customers, and internal stakeholders during assessments, walkthroughs, interviews, demonstrations, and evidence reviews.
Develops, maintains, and tracks Plan of Action and Milestones (POA&M) documentation, remediation activities, corrective action plans, and risk mitigation efforts.
Tracks security findings, compliance gaps, remediation activities, risk acceptances, and corrective action plans through closure.
Evaluates existing information security policies, standards, procedures, and governance documentation and recommends improvements ensuring compliance with applicable frameworks.
Develops, maintains, and updates compliance-aligned policies, standards, procedures, and governance documentation supporting authorization readiness.
Defines roles, responsibilities, accountability requirements, and separation-of-duty controls supporting governance and compliance programs.
Establishes processes supporting risk management, control assessment, continuous monitoring, and control validation.
Aligns organizational security policies and governance requirements with implemented technical controls and operational practices.
Develops and maintains governance framework documentation, security program documentation, and compliance operating procedures.
Develops and maintains Incident Response Plans (IRP), incident response procedures, and incident response playbooks aligned to regulatory reporting and notification requirements.
Develops and maintains Business Continuity Plans (BCP), Disaster Recovery Plans (DRP), backup strategies, recovery procedures, and restoration processes.
Conducts tabletop exercises, functional exercises, continuity exercises, and after-action reviews to validate incident response and disaster recovery capabilities.
Maintains documentation and evidence supporting Incident Response (IR), Contingency Planning (CP), and other control families.
Defines and documents operational security processes including access request management, identity lifecycle management, privileged access controls, change management, configuration management, vulnerability management, and security exception processes.
Establishes onboarding and offboarding workflows supporting personnel security and access control requirements.
Supports implementation and operation of change management processes.
Participates in internal and external audits, compliance assessments, control reviews, and continuous monitoring activities.
Defines security awareness, role-based training, and compliance training requirements.
Maintains training records, compliance evidence, and authorization readiness documentation.
Collaborates with cross-functional teams including security engineering, cloud engineering, infrastructure, service delivery, legal, compliance, and executive leadership teams.
Participates in incident response activities, risk assessments, and compliance audits.
Supports current system analysis to identify and recommend technical and administrative controls required to satisfy compliance obligations.
Provides technical expertise and compliance guidance for the information security program.
Collaborates as a member of the Information Security Office to maintain compliance objectives and authorization readiness.
Maintains communication with the Director, Information Security, regarding security posture, compliance initiatives, audit readiness, authorization activities, risks, and remediation efforts.
Ensures Presidio maintains compliance with security requirements and authorization obligations.
Ensures compliance with framework requirements necessary to obtain and maintain certifications and government authorizations.
Provides emergency on-call support as required.
Performs other duties as assigned.