INFORMATION SECURITY ANALYST

About the Role

We are seeking an experienced Information Security Analyst with strong expertise in cybersecurity risk management, security audits, compliance, internal controls, and security governance.

Responsibilities

• Conduct security assessments, audits, and risk reviews and document findings and recommendations.
• Prepare audit reports, risk assessments, security plans, incident reports, and POA&Ms.
• Review and maintain security policies, audit plans, risk documentation, and compliance artifacts.
• Evaluate security controls and identify areas of non-compliance and improvement.
• Track remediation activities and report outcomes to management.
• Research cybersecurity regulations, standards, and industry best practices to support compliance.
• Identify cybersecurity and privacy risks across internal and external systems and recommend mitigation strategies.
• Support project teams with security and compliance requirements.
• Collaborate with IT, security, audit, compliance, and business teams.
• Provide security guidance and develop training/user-support materials as required.

Requirements

• Experience performing security risk assessments, audits, control reviews, and compliance assessments.
• Strong knowledge of NIST SP 800-53 Rev. 5, RMF, IRS Publication 1075, HIPAA/HITECH, HITRUST, CJIS, and MARS-E.
• Experience with security and privacy control selection, implementation, assessment, and authorization.
• Strong knowledge of information security policies, risk management, internal controls, and audit practices.
• Experience identifying security gaps, developing findings, recommendations, POA&Ms, and remediation plans.
• Ability to investigate suspicious activity and support security incident reporting.
• Understanding of IT environments including Windows, Unix/Linux, databases, networking, and software development.
• Strong technical documentation, analytical, written, and verbal communication skills.