Senior Analyst, Information Security Risk & Compliance

Senior Analyst, Information Security Risk & Compliance

Security Risk & Compliance

US Exempt Regular

Full time

Stateside Exempt 4.2

Location: Adelphi, MD (Hybrid)

Summary:

The Senior Analyst, IS Risk & Compliance performs security risk assessments, audits, and/or inspections, of the computing environment for UMGC’s customers. The Senior Analyst, IS Risk & Compliance is responsible for delivering executing security assessments, promoting effective IT internal controls and risk management, and providing guidance to IT and business units on all aspects of internal & external audits, governance, and business process improvements.

Additionally, the Senior Analyst, IS Risk & Compliance key role is to provide an independent opinion on the suitability of the IT risk management framework and to provide objective assurance that the risks in the business are being appropriately managed and that controls are operating as expected. You will be responsible for implementing the assessment process, educating stakeholders, building partnerships , and socializing security best practices.

Duties and Responsibilities:

• Planning, preparation and completion of the assigned audits to include assessing the effectiveness and compliance with policies, laws/regulations and best standards.

• You are also expected to conduct Kick-off Meetings, IT internal control testing, develop IT internal audit plans, conduct IT audit closure meetings and provide other IT internal audit services.

• Collaborate with departments to improve security compliance and manage technology risk. 

• Assist in developing system security plans (SSPs) and ensure they meet NIST SP 800-171 control requirements and other required standards.  

• Assist in developing and/or reviewing IT security policies. 

• Provide corrective action support to include developing Plan of Actions and Milestones (POA&Ms), monitor milestones, and support completion of action steps for any deficiencies identified in systems. 

• Strong understanding of various laws/regulations to include, but not limited to, CMMC, GLBA, FERPA, PCI-DSS, and GDPR and ability to execute audit plans to assess compliance.

• Able to identify relevant IT risks and to properly document the audit/assessment process, gaps, and remediation steps.

• Collaborates with business units to enhance IT security posture.

• Work closely with security operations team, server operations, network operations, and application teams and ensure security practices comply with applicable laws and regulations.

• Assess security products and effectiveness of various security products to include firewalls, intrusion detection systems, antivirus, patch management, etc.

• Review and provide input into network designs to ensure compliance with security and enterprise architecture.

• Provide input and visibility into emerging security technologies, deployment strategies and other security protocols to ensure awareness within the IT security branch. 

• Review in-house and 3rd-party applications and code for security vulnerabilities and best practices. 

• Develop and/or implement automated security assessment testing tools where possible. 

• Act as a liaison to interpret external audit requests, describe what should be provided, and suggest possible options. 

• Strong understanding of cloud (Azure) and network environments.

Skills:

• Demonstrated process improvement experience.

• Recognized as a strategic thinker and is results oriented.

• Demonstrated effective strong team player and self-motivator. Ability to work and interface internally with IT and other functional support groups with minimal guidance.

• Demonstrated successful experience in a customer-facing role.

• Excellent written and oral communication skills.

Education & Experience Requirements:

Experience:

• 7+ years in IT audit.

• Strong understanding of the NIST 800 special publications (e.g. NIST 800-171, NIST 800-53, Risk Management Framework, etc) and DoD CMMC.

• Collaborating with IT and business stakeholders to plan the engagement and develop work program timelines, risk assessments and other documents/templates.

• Lead and execute IT audit engagements.

• Experience in applying relevant technical knowledge in the following engagements: (a) ITGC audits; (b) IT internal or operational audits; (c) Service Organization Controls (SOC) Reporting engagem