Security & Compliance System Analyst

Location: Lansing, MI
Work Arrangement: Hybrid Onsite Tuesday & Wednesday
Duration: 12 Months + Possible Extension
Interview: In-Person

Important Work Requirements

• Must be able to work onsite in Lansing, MI two days per week (Tuesday and Wednesday) starting Day 1.
• Remote-only candidates will not be considered.
• Candidates within 75 miles of Lansing, MI are strongly preferred.
• Candidates outside the 75-mile radius must be willing to relocate to the Lansing area within 2 weeks of starting, at their own expense.
• An in-person interview is required.

Job Summary

We are seeking a Senior Security & Compliance System Analyst to support security, compliance, risk management, and business continuity initiatives for critical public-sector systems.

The ideal candidate will have strong experience with NIST security frameworks, GRC/compliance processes, security controls, disaster recovery, business continuity, risk assessments, and security audits. This role will work closely with business stakeholders, technical teams, and security professionals to ensure systems and processes meet security and regulatory requirements.

Key Responsibilities

• Analyze, document, and validate security and compliance requirements.
• Develop and maintain security requirements, user stories, workflows, use cases, and audit-ready documentation.
• Support security assessments, audits, control validation, and risk assessments.
• Apply NIST CSF, NIST 800-53, and applicable state security standards.
• Work with technical and business teams to integrate security and compliance requirements into system development and enhancements.
• Support UAT and testing to validate security controls and requirements.
• Identify security and compliance gaps and recommend mitigation strategies.
• Monitor security-related project deliverables, milestones, risks, and remediation activities.
• Support development and maintenance of System Security Plans, Assessment Reports, and Authorization documentation.
• Assist with Disaster Recovery (DRP) and Business Continuity (BCP) planning and testing.
• Support Business Impact Assessments and define RTOs and RPOs.
• Participate in tabletop exercises and disaster recovery simulations.
• Coordinate vulnerability scans and analyze scan results to prioritize risks and remediation.
• Support internal and external security reviews and audits.
• Prepare compliance, risk, security, and performance reports.
• Collaborate with cross-functional teams and guide security and compliance best practices.

Required Qualifications

• 7+ years of professional experience in security, compliance, risk management, GRC, or a related field.
• 5+ years of experience with NIST CSF and NIST 800-53 or similar public-sector security frameworks.
• 5+ years of experience with GRC, compliance tracking, or security workflow tools, such as Azure DevOps or similar platforms.
• 5+ years of experience with Disaster Recovery Plans (DRPs) and Business Continuity Plans (BCPs).
• Experience defining or supporting RTO and RPO requirements.
• Experience with security controls, compliance assessments, audits, and risk assessments.
• Experience supporting security requirements throughout the Agile SDLC.
• Understanding of common security vulnerabilities including SQL Injection, XSS, CSRF, and authentication weaknesses.
• Strong documentation, analytical, communication, and stakeholder-management skills.

Preferred Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Information Systems, Public Administration, or a related field.
• Previous government, public-sector, or military experience.
• Experience supporting retirement, pension, benefits, or other regulated systems.
• Experience with SQL, Power BI, or advanced Excel.
• Security/compliance certifications such as CISA, Security+, CGRC, CAP, CISSP, CISM, or similar.
• Knowledge of state and federal security, privacy, and compliance requirements.
• Familiarity with Java or .NET environments.
• Understanding of web application architecture and security.