Security Analyst; Prjt Mgmt processes; IT concepts; security concepts; Micros Tools; SaaS​/COTS

Security Analyst

FLDOT-6810

The Information Security Management (ISM) Office is responsible for ensuring the security of IT assets and systems within the Department. A key component of that is done by initiating and analyzing system security risk assessments. This position supports the System Security Risk Assessment and Risk Management function of the Florida Department of Transportation. These functions are described in The Florida Cybersecurity Standards, F.A.C. 60GG-2.

Under direction of the ISM, this position will be responsible for coordination and guiding completion of the system security review assessment process; supporting the Risk Steering Workgroup; working with the ISM to develop the process for third-party vendor risk assessments; and once the process is developed - coordinating and guiding completion of third-party vendor risk assessment.

This position will be heavily involved in the transition from the current system security risk assessment process that includes assessments created in Word, and processed with workflows in Sharepoint to a cloud-based Software as a Service (SaaS) system. This position will be required to document the as‑is processes, work with the team to evaluate their effectiveness, and then revise business processes as needed to support the transition into the chosen SaaS solution.

The Department is looking at tool sets considered Governance Risk and Compliance (GRC), Information Technology (IT) Audit, or Integrated Risk Management (IRM). The tool has not been selected. This position will be involved in the workgroup to select and implement the tool.

The candidate must have an understanding and/or experience with risk and compliance work — including identifying the appropriate standards set, assessing if a system meets standards, and then documenting and communicating the concerns to the System Owner/System Coordinator. The goal of this process is to identify security controls that would be most appropriate for a system based on the security risk the system poses.

This position is not expected to be a technical expert in security controls for systems; but is expected to understand general information technology concepts that would allow them to grasp and advance the process and goals, as well as become more knowledgeable of security controls over time.

This position will also assist the ISM in expanding and formalizing the risk management function, which includes Developing and maintaining a risk register; proactively tracking and documenting risk and presenting it to the Risk Steering Workgroup for review and appropriate action.

Communication is critical to this position. This position must be able to explain this process to System Developers, System Owners, and Project Managers so that they understand the importance of the risk reviews. This position must be able to communicate risk issues to business staff at all levels of the organization. This position must be a champion for this process and should proactively create marketing material regarding the process for review.

This position will also assist the ISM in expanding FDOT's third‑party risk assessment program, and risk escalation/risk steering workgroup. Documentation of policies, procedures, user instructions, etc. will be required of this position. Must have strong organizational and project management skills and excellent writing and editing skills. Must understand risk‑based decision making. Must be self‑directed, professional, and willing to take ownership of this important process.

• Initiate System Security Risk Assessments on systems being implemented within the Department. This includes systems written by FDOT staff/consultants, commercial off the shelf (COTS) systems or Software as a Service (SaaS) offerings.
• Develop and use reports and metrics to identify a risk‑based approach to addressing systems that have not undergone a system security risk assessment.
• Keep track of status and ensure progress of system security risk assessments.
• Work with ISM Team to develop Policies, Procedures and Guidelines supporting the Risk Assessment process.
• Perform Quality…