Security Analyst Consultant

Job Title: Senior Information Systems Security Officer (Security Analyst Consultant)

The Office of Cybersecurity (OCS) is responsible for safeguarding the security and compliance of information systems and data. We are seeking an experienced Senior ISSO to lead and support day-to-day security and compliance requirements across complex information system environments. This role will focus on implementing and enhancing security and compliance programs aligned with regulatory frameworks such as FISMA NIST CMS MARS-E and HIPAA.

• Lead and manage security and compliance initiatives across information systems.

• Develop maintain and review System Security Plans (SSPs) PIAs ISAs CMAs and related RMF/A&A artifacts.

• Perform architectural reviews and risk assessments of:

  • Network design and data flow

  • System and data access models

  • Firewall rule requests (ports protocols services)

  • Vulnerability management

• Audit internal systems and vendor environments for compliance with agency standards.

• Review and provide recommendations on contracts agreements and compliance documentation.

• Act as the primary contact for third-party audits and assessments.

• Collaborate with leadership vendors and business partners to provide security recommendations and risk mitigation strategies.

• Document findings reports and recommendations using tools such as Microsoft Office Archer eGRC Bizagi and Atlassian.

• 5 years of IT security experience auditing/working with IBM System 390/zSeries Windows Linux databases (relational & non-relational) networking and web applications.

• Strong working knowledge of FISMA NIST CMS MARS-E and HIPAA standards.

• Proven experience within a FISMA-compliant security program.

• Hands-on experience with eGRC systems (Archer preferred).

• Prior healthcare IT security experience.

• Professional security certification required: ISC(2) ISACA SANS GIAC or equivalent.

• Strong communication and collaboration skills with the ability to engage both technical and non-technical stakeholders.

• Proficiency in Microsoft Office (Word Excel PowerPoint Visio).

• Prior ITIL experience in Information Security Management.

• Experience integrating RMF/A&A processes into the SDLC.

• Familiarity with cloud security and vendor risk management.

• BS in Computer Science or related discipline (or 10 years equivalent experience).