About the job IT Security Analyst
The main responsibilities are :
- The IT Security Analyst is responsible for completing and maintaining system security plans (SSP) for new and existing systems.
- This requires close coordination with IT project teams, business and enterprise security representatives, and product owners, to establish and maintain processes and controls for security vulnerability remediation.
- Create system security plans (SSP) for new applications in alignment with the Secure Application Development Life Cycle (SADLC) and Michigan Security Accreditation Process (MiSAP).
- Maintain SSPs for existing applications requiring authority to operate (ATO) and those facing software and / or hardware enhancements.
- Continuously monitor plans of action and milestones (POA&M) and corrective action plans (CAP) as they relate to the SSPs in collaboration with the MDOT Enterprise Information Management (EIM) office.
- Validate respective SSPs to ensure NIST control requirements are met.
- Author recommendations associated with your findings on how to improve the customers security posture in accordance with SOM PSP & NIST controls.
- Assist team members and vendors with proper artifact collection to satisfy assessment requirements.
Experience, Skills, Knowledge :
Top Skills
1 year experience in the IT industry analyzing and applying information security principles and practices1 year experience reviewing IT systems / applications plus basic knowledge of networking components and various operating systems1 year experience analyzing the applicable NIST Special Publications 800-37 Revision 1, 800-53 Revision 3,4 or 5, and 800-53A Revision 12 years experience with other Security Frameworks (ISO, NIST, COBIT, HIPAA / HITECH, etc.) and regulatory requirements is a plusCISSP, CISA, PMP and / or Security+ certification (Nice to have)Experience working with software vendors to implement security controls (Nice to have)Experience working independently and in a team environmentStrong written and verbal communication skills including the ability to explain technical matters to a non-technical audienceAbility to collaborate on multiple projects / efforts at a given timeFlexibility to adjust quickly to multiple demands, shifting priorities, ambiguity, and rapid change