Cybersecurity Analyst II

Responsibilities

• Provide security and risk management services, including risk identification, assessment, remediation, and regulatory compliance monitoring for on‑premises and cloud environments (Microsoft Azure, AWS).
• Conduct cyclical technology risk assessments, web application security analysis, vulnerability analysis, and evaluate emerging threats.
• Facilitate risk assessment sessions, document threats, vulnerabilities, likelihood, impact, and mitigation strategies in a GRC tool; validate and prioritize vulnerability scan results and track remediation.
• Assist with the development and maintenance of System Security Plans (SSPs) aligned with NIST SP 800‑53, NIST RMF, DIR standards, and agency CISO policies.
• Plan and conduct security assessments of administrative, technical, and operational controls; prepare formal reports, track remediation, and manage Plans of Action and Milestones (POA&Ms).
• Perform risk‑based needs assessments focusing on cloud security posture management (CSPM) and web application vulnerabilities to identify compliance gaps.
• Maintain security artifacts, risk records, continuous‑monitoring evidence, and compliance documentation within a GRC platform (e.g., RSA Archer); support Authorization to Operate (ATO) activities.
• Prepare audit documentation, reporting packages, and responses for internal reviews, external audits, and leadership inquiries.
• Advise stakeholders on secure architecture, secure application development standards, and cloud security best practices; deliver targeted security training.
• Perform other duties as assigned.

Requirements

• U.S. citizenship or permanent residency.
• On‑site work in Austin, Texas (701 W 51st St).
• Graduation from an accredited four‑year college or university with major coursework in information technology security, computer information systems, computer science, management information systems, or a related field (or equivalent experience).
• At least 3 years of experience in information security analysis.
• One or more of the following certifications is preferred: CompTIA Security+, Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC) or similar.
• Ability to obtain and maintain any required background, security, and employment eligibility checks (including E‑Verify and I‑9 documentation).

Skills

• Advising diverse stakeholders on secure architecture, secure application development standards, and cloud security best practices.
• Preparing audit documentation, assessment reports, ATO packages, and leadership‑level reporting with clear, concise communication.
• Risk analysis and vulnerability management, including validation, prioritization, and tracking of remediation.
• Conducting security and risk‑based needs assessments of automated systems and business initiatives.
• Using enterprise GRC platforms (e.g., RSA Archer) to maintain risk records, POA&Ms, exceptions, and continuous‑monitoring evidence.
• Applying NIST SP 800‑53 control families, NIST RMF steps, DIR security control standards, and agency CISO policies to system documentation.
• Evaluating cloud configurations for misconfigurations and control gaps across Azure and AWS environments (CSPM concepts and tooling).

Benefits

Comprehensive benefits package includes 100 % paid employee health insurance for full‑time eligible employees, a defined benefit pension plan, generous time‑off benefits, numerous career‑advancement opportunities, and additional details available on the Benefits of Working at HHS webpage.

Pay

Salary range: $5,797.66 – $7,500.00 per month (pay frequency: monthly). Salary is determined in accordance with budgetary limits and HHSC Human Resources Manual.

Schedule

• Full‑time, exempt position.
• Day shift (first shift).
• Telework may be eligible subject to agency policies and supervisor discretion.