Security Awareness & Compliance Analyst

Location: Harrisburg, PA
Work Arrangement: Hybrid — 3 days onsite / 2 days remote at Forum Building, 607 South Drive, Harrisburg, PA 17120

About the role

We are seeking a Security Awareness & Compliance Analyst to support the Commonwealth of Pennsylvania’s Enterprise Information Security Office (EISO) and its Governance, Risk, and Compliance (GRC) function. This role is ideal for a cybersecurity professional with hands-on experience in security awareness programs, phishing simulations, cybersecurity training, compliance reporting, and audit support. The selected candidate will administer enterprise security awareness initiatives, coordinate phishing simulation campaigns, analyze program effectiveness, develop educational communications, and support broader GRC activities.

Responsibilities

• Administer and maintain the enterprise Security Awareness Program.
• Plan, coordinate, and execute phishing simulation campaigns.
• Track, analyze, and report security awareness and phishing metrics using established reporting tools.
• Coordinate required cybersecurity awareness training across the organization.
• Develop and distribute engaging security awareness communications and educational materials.
• Maintain program documentation and records supporting compliance and audit requirements.
• Assist with reports for regulatory requirements, audits, management reviews, and compliance activities.
• Analyze program metrics, identify trends, and recommend improvements.
• Enhance awareness activities based on emerging cybersecurity threats and industry best practices.
• Support Governance, Risk, and Compliance (GRC) initiatives and cybersecurity continuous-improvement activities.

Requirements

Successful candidates should demonstrate experience with:

• Security awareness and cybersecurity education programs.
• Planning and executing phishing simulation campaigns.
• Security awareness and phishing simulation platforms.
• Cybersecurity fundamentals and information security awareness principles.
• Security metrics, reporting, and data analysis.
• Compliance documentation and audit support.
• Regulatory and management reporting.
• Developing clear, user-friendly cybersecurity communications and training materials.
• Coordinating multiple projects and training activities simultaneously.
• Analyzing program results and identifying trends or opportunities for improvement.

Skills

We are looking for someone who can combine cybersecurity knowledge with strong communication and analytical skills. You should be comfortable working with diverse audiences, translating security concepts into practical educational content, analyzing awareness metrics, and maintaining organized documentation for compliance and audit purposes. Strong organizational skills and the ability to establish productive working relationships with agency stakeholders are important for success in this role.

Schedule

This is a hybrid position requiring 3 days per week onsite and 2 days remote. Candidates must be local to Harrisburg or the surrounding area and able to meet the onsite requirement.