Senior Consultant - Cybersecurity Compliance Analyst

Senior Consultant - Cybersecurity Consultant

Join to apply for the Senior Consultant - Cybersecurity Consultant role at New York State Technology Enterprise Corporation (NYSTEC).

NYSTEC is a nonprofit technology consulting company, advising agencies, organizations, institutions, and businesses since 1996. We’re independent and vendor-neutral, so we have our clients’ best interests  NYSTEC, we know that we succeed when individuals and teams flourish personally and professionally, so our benefits and perks support that mindset.

As a senior consultant on the Cybersecurity and Data Privacy team, you will collaborate with team members to support our clients as you expand your knowledge related to assessing and securing cloud-based solutions, application protocol interfaces (APIs) and artificial intelligence (AI) technologies. NYSTEC is considered a trusted advisor, providing cybersecurity subject matter expertise and program operations support for our clients. Your day-to-day role as a NYSTEC consultant will involve providing support for our client’s security program.

Our client’s security program oversees vendor- and data-consuming-entity security compliance, including security control analysis. Cybersecurity team members also support security program elements, such as incident response, vulnerability management, and anti-phishing efforts. This position is expected to be performed on-site in Albany, NY.

• Integrating identity and access management, such as NY.Gov , into client system initiatives.
• Preparing and delivering summaries, reports, and presentations to communicate complex technical security and privacy information, and make actionable recommendations to both technical and nontechnical stakeholders.
• Assisting with developing and maturing API and AI security standards.
• Coordinating with the web and application security testing team.
• Ensuring regulatory compliance with the Health Insurance Portability and Accountability Act (HIPAA), Centers for Medicare & Medicaid Services (CMS) Acceptable Risk Safeguards (ARS), New York State standards and policies, and National Institute of Standards and Technology (NIST) Special Publication 800-53.
• Conducting security compliance assessments.
• Preparing security documentation and policies.
• Supporting audits and CMS reviews.

• Excellent work ethic, critical thinking, analytic, and problem-solving skills.
• Clear and concise written and verbal communication skills.
• Diplomacy and stakeholder relationship development and management skills.
• Sound operational technical background.
• Knowledge of, and experience with, implementing NIST 800-53 controls and an understanding of the IT security processes behind those controls.
• Ability to assess IT risk in a client’s environment and a desire to learn NIST 800-30 style risk assessments.
• Security certification from an accredited organization, such as ISC
  2.

• Skills across multiple security domains.
• Experience with privacy programs, requirements, and controls.
• Knowledge of the New York State Medicaid program, its systems, data, and uses.
• Expertise in public health, health information, or security and privacy policies and standards, such as NIST 800-53 and CMS ARS.
• Expertise with identity and access systems and modern protocols, such as Security Assertion Markup Language (SAML), Open Authorization (OAuth), OpenID Connect, multi-factor authentication (MFA), etc.
• Experience with vulnerability assessments of cloud services and infrastructure.
• Familiarity with the secure software development life cycle (SSDLC) and technologies and the causes of vulnerabilities.
• Ability to articulate risk and mitigation strategies to clients in written and verbal communications.
• A background in software development or system administration.

• A bachelor’s degree and five to seven years of experience in an operational or information security role.
• An equivalent combination of advanced education, training, and experience (e.g., relevant classwork or outside training and security certifications) may be considered.

The target base salary for this…