Information Security Analyst

About The Kentucky Education and Labor Cabinet (ELC)

The Kentucky Education and Labor Cabinet is committed to meet or exceed the needs and expectations of our business customers and citizens. We strive to continually improve both the delivery of our products and services and the processes which support that delivery.  The Office of Policy and Audit within the ELC makes decisions based on this commitment and always strives to provide value to our business units and external stakeholder community.

Location

Office Location: 500 Mero St, Frankfort, KY 40601

Contracted Staff: Contractors may be eligible for full-time telecommute status.

The ELC currently operates as a hybrid telecommute agency, with staff working 60% in-office and 40% remotely (typically 3 days in the office and 2 days remote). Employees may choose their remote workdays, though Wednesday is designated as a common in-office day for all staff.

As an executive branch agency, the ELC is subject to the policies and directives of the elected Executive Branch. This includes any future adjustments to telecommuting policies, which may expand or limit current arrangements.

Job Overview

We are seeking a detail-oriented and analytical Information Security Analyst to join our security team. This role is responsible for developing and maintaining information security policies, standards, and procedures, as well as managing and supporting the organization’s response to security audits, assessments, and compliance inquiries. Someone with governance, risk, and compliance (GRC) experience and focus.

The ideal candidate will have a strong foundation in information security governance, regulatory frameworks (e.g., NIST, ISO 27001, SOC 2, HIPAA), and the ability to communicate effectively with both technical and non-technical stakeholders.

Core Responsibilities

Policy Development & Maintenance

·       Develop, review, and update security policies, procedures, and standards in alignment with regulatory and industry frameworks (e.g., NIST, ISO 27001, CIS).

·       Collaborate with internal stakeholders (IT, Legal, HR, Commonwealth Office of Technology) to ensure policies are practical, understood, and enforced.

·       Track policy lifecycle and version control.

Audit & Compliance Support

·       Lead or assist in responding to third-party audits, internal audits, and customer security questionnaires.

·       Gather and organize required documentation, evidence, and technical input to support audits.

·       Work with external auditors during SOC 2, ISO 27001, or other compliance assessments.

Governance & Risk Management

·       Support risk assessments and control gap analysis across business units.

·       Participate in the implementation and tracking of corrective actions or remediation plans.

·       Maintain documentation for risk management and compliance reporting.

Awareness & Training

·       Help develop and deliver security awareness training to staff, focusing on policy adherence and compliance readiness.

·       Promote a culture of security and compliance across the organization.

Technical Skills

Required:

·       4–7 years of experience in information security, GRC, or audit/compliance support.

·       Familiarity with standards such as NIST 800-53, ISO 27001, SOC 2, HIPAA, PCI-DSS, or GDPR.

·       Strong writing skills with the ability to create clear and concise policies.

·       Experience participating in security audits and assembling evidence packages.

·       Excellent organizational, communication, and collaboration skills.

Preferred:

·       Bachelor’s degree in Cybersecurity, Information Systems, or related field.

·       Certifications like CISSP, CISA, CISM, ISO 27001 Lead Implementer, or Security+.

ELC is looking for someone with the following technical skills

·       Coordinate with COT to schedule security scans (Penetration testing, vulnerability scans, etc.) and review, interpret and respond to findings.

·       Knowledge and understanding of

§  Open Worldwide Application Security Project (OWASP) Top 10

§  API Security (OAuth2, OpenID Connect)

§  Container security

§  Ability to review CI/CD pipeline configurations (i.e. Jenkins, GitHub Actions, Azure DevOps) for security control compliance

§  Ability to review secrets management practices (i.e. HashiCorp Vault, AWS Secrets Manager, etc.) for policy compliance.

·       Understanding of application layer threats and controls

Minimum Requirements  

• Excellent written and oral communication skills in English. Must be able to effectively and comfortably communicate with all types of individuals from the customer technical expert to the customer executive management
• Bachelor’s Degree with a focus in IT or equivalent combination of experience/knowledge
• Knowledge of and experience with Agile processes
• Strong analytical, design and problem-solving skills
• Ability to work independently/self-reliant and show initiative with minimum supervision
• Ability to quickly learn new technologies and apply appropriately to business situations
• Strong team player who enjoys working in a fast-paced team atmosphere
• Ability to work under pressure; meet strict deadlines
• Ability to listen effectively and seek clarification
• Ability to build a rapport with clients