IT Consultant 1 ITC1 (Security Resource)

1. Risk Assessment and Analysis

1. Lead complex IT risk assessments and threat modeling activities across systems and applications.
2. Analyze trends and emerging risks to proactively recommend strategic mitigations.

1. Risk Mitigation and Management

1. Develop and oversee implementation of advanced risk mitigation strategies.
2. Monitor risk programs and revise controls based on performance metrics and audit outcomes.

1. Compliance and Governance

1. Ensure enterprise-wide compliance with federal and state regulations including HIPAA IRS Pub. 1075 NIST 800-53 MARS-E and ISO standards.
2. Support policy lifecycle management and contribute to enterprise GRC strategy.

1. Incident Management

1. Provide leadership in incident response and post-incident reviews.
2. Collaborate with internal teams on root cause analysis and long-term remediation planning.

1. Review System Security Plans (SSPs)

1. Review update and validate system security documentation for critical systems.
2. Ensure alignment with internal risk policies external contractual requirements and frameworks such as NIST and CIS.

1. External Audit Support

1. Serve as a key liaison to auditors and regulatory assessors.
2. Oversee evidence collection audit response documentation and control testing coordination.

1. IT Security Policy Leadership

1. Lead the creation and revision of organizational IT security policies.
2. Recommend and draft policy enhancements based on risk assessment results audit findings and regulatory changes.

1. Reporting and Documentation

1. Prepare and deliver executive-level reporting on risk posture findings and recommendations.
2. Maintain thorough documentation aligned with organizational and audit standards.

1. Collaboration and Communication

1. Represent IT risk in executive discussions technical project meetings and external partner engagements.
2. Coach and mentor junior staff IT and business personnel.

Qualifications:

• Education:
  Bachelors degree in Information Technology Computer Science Cybersecurity or a related field is required.
  Masters degree in a related field preferred.
• Experience:
  Minimum of 7 to 10 years of experience in IT risk management cybersecurity or information assurance.
  Demonstrated success leading cross-functional projects and managing compliance for large systems. Experiences in Heath and Human Services or Healthcare business preferred.
• Certifications (Preferred):
  CISA CISSP CRISC CISM CGEIT or similar credentials.
• Technical Skills:
  Expertise in risk frameworks (NIST 800-53 MARS-E ISO 27001) vulnerability management system security plans and audit lifecycle management.
• Analytical Skills:
  Exceptional critical thinking data analysis and risk prioritization abilities.
• Communication Skills:
  Strong verbal and written communication skills with the ability to tailor information to different audiences including executives.