Security Analyst

About the Role

This role serves as a senior security and compliance analyst within the our client, Management and Budget’s Agency Services, supporting multiple state agencies. The analyst will work in a collaborative, hybrid environment, providing strategic guidance on system security plans and disaster recovery documentation. By acting as the primary liaison between business units, technical teams, and security groups, the candidate will ensure alignment with state‑wide security standards and our client regulations. The position offers the opportunity to influence the security posture of critical public‑sector applications while delivering measurable compliance outcomes.

Key Responsibilities

• Develop, maintain, and update System Security Plans (SSPs) and Disaster Recovery Plans (DRPs) for assigned applications.
• Conduct comprehensive audits and provide evidence to satisfy NIST, PCI, HIPAA, and FERPA requirements.
• Lead cross‑functional meetings, preparing and delivering clear oral and written compliance reports to stakeholders.
• Serve as the primary liaison between business owners, IT development teams, and security groups to translate requirements into actionable security controls.
• Assess complex web‑based applications for security vulnerabilities and recommend remediation strategies.
• Coordinate with state security governance to ensure all documentation meets Michigan standards and our client guidelines.
• Provide training and guidance to junior analysts on compliance processes and best practices.
• Monitor and report on compliance status, identifying gaps and driving corrective actions.
• Support incident response activities by supplying relevant compliance documentation and evidence.

Required Skills & Experience

• Minimum 5 years of experience delivering audit evidence for NIST, PCI, HIPAA, and FERPA compliance frameworks.
• At least 5 years of hands‑on experience with complex IT web applications, including security assessment and risk analysis.
• Proven ability to lead meetings, facilitate discussions, and produce high‑quality written and oral reports.
• Strong interpersonal skills with a track record of acting as a liaison between business and technical teams.
• Excellent analytical and problem‑solving abilities, with attention to detail in documentation.
• Bachelor’s degree in Information Security, Computer Science, or a related field; relevant certifications (CISSP, CISM, CISA, or equivalent) are preferred.

Tools & Technologies

• Security frameworks and standards: NIST SP 800‑53, PCI DSS, HIPAA, FERPA.
• Compliance and GRC platforms (e.g., ServiceNow GRC, RSA Archer, or similar).
• Vulnerability scanning and assessment tools (e.g., Nessus, Qualys, or OpenVAS).
• Documentation and reporting tools such as Microsoft Office Suite, SharePoint, and PDF editors.
• Issue tracking and ticketing systems for coordinating remediation efforts.

Work Schedule & Duration

• One‑year contract with a high likelihood of extension.
• Hybrid work model: onsite two days per week, remote for the remaining days; no remote‑only option.
• Candidate must reside within 90 miles of Lansing, Michigan at the time of submission.

Interview Process

The interview process typically includes an initial virtual interview followed by a potential in‑person second round. Candidates must be available for an on‑site interview as part of the selection process.

Position Details

• Employment Type: Contract
• Duration: Approximately 12 months (with potential for extension)
• Work Authorization: Must be authorized to work in the United States