Security Analyst

About the Role

This position supports the integrity, security, and compliance of systems used to administer retirement benefits for public‑sector employees. The analyst will work in a collaborative, hybrid environment, partnering with cross‑functional teams to ensure technology solutions meet state regulations and industry‑standard security frameworks. By strengthening security controls and improving business processes, the role directly protects sensitive employee data and contributes to the resilience of critical public services.

Key Responsibilities

• Develop, maintain, and update security documentation and compliance artifacts in alignment with NIST CSF, NIST SP 800‑53, and state IT security standards.
• Utilize Azure DevOps and GRC platforms to track compliance activities, manage workflow approvals, and generate audit‑ready reports.
• Contribute to the creation, testing, and continual improvement of Disaster Recovery Plans (DRPs) for mission‑critical systems.
• Define, monitor, and report on Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) to ensure business continuity.
• Collaborate with IT, operations, and business stakeholders to identify security gaps and implement remediation actions.
• Conduct periodic security assessments, risk analyses, and control reviews to verify adherence to policies.
• Support internal and external audit processes by providing evidence, responding to findings, and implementing corrective measures.
• Provide training and guidance to staff on security best practices and compliance requirements.
• Stay current with emerging threats, regulatory changes, and industry best practices to proactively enhance the security posture.

Required Skills & Experience

• Minimum 5 years of experience applying security and compliance frameworks (NIST CSF, NIST SP 800‑53, state IT security standards) in a public‑sector environment.
• Proven expertise with tools for security documentation, compliance tracking, and workflow management (e.g., Azure DevOps, GRC platforms).
• Extensive experience developing, testing, and maintaining Disaster Recovery Plans and defining RTO/RPO metrics.
• Strong analytical skills with the ability to assess risk, recommend controls, and communicate findings to both technical and non‑technical audiences.
• Preferred background in our client or military settings, demonstrating familiarity with public‑sector security requirements.
• Bachelor’s degree in Information Security, Cybersecurity, Information Systems, Public Administration, or a related discipline.

Tools & Technologies

• Azure DevOps – for work item tracking, documentation, and collaboration.
• GRC platforms (e.g., RSA Archer, ServiceNow GRC) – for compliance management and audit reporting.
• Microsoft Office Suite – for creating policies, procedures, and presentation materials.
• Security assessment tools – for vulnerability scanning and risk analysis (e.g., Nessus, Qualys).
• Disaster recovery planning tools – for scenario modeling and testing.

Work Schedule & Duration

• One‑year contract with the possibility of extension.
• Hybrid schedule: onsite two days per week (Tuesday and Wednesday) starting day 1; no remote‑only option.
• Onsite location: 530 West Allegan Street, Lansing, MI.
• Local candidates within a 75‑mile radius preferred; out‑of‑area candidates must relocate independently within two weeks of start date.

Interview Process

The interview process consists of an in‑person interview in Lansing, MI. Candidates can expect a discussion of technical expertise, scenario‑based questions on security and compliance, and a review of relevant experience.

Position Details

• Employment Type: Contract
• Duration: Approximately 12 months (with potential for extension)
• Work Authorization: Must be authorized to work in the United States