Information Security GRC Analyst

Quantam Solutions provides IT solutions and consulting for various clients. We offer competitive hourly wages, health benefits, paid time off, and a 401(k) plan. We are currently seeking an Information Security GRC Analyst
. This position is fully onsite in Frankfort, Kentucky. Candidates must currently reside in Kentucky and be able to commute to Frankfort.

Our client is seeking an Information Security Analyst to support technology, information security, Governance, Risk, and Compliance (GRC), and driver licensing operations.

The successful candidate will support driver licensing systems, issuance technology, REAL , and related applications and infrastructure. This position will also provide information security and GRC support, including security control assessments, risk assessments, compliance monitoring, security documentation, audit and evidence management, and continuous monitoring activities.

The Information Security Analyst will work closely with System Administrators, IT staff, management, vendors, developers, and other stakeholders to identify security and operational risks, support compliance requirements, improve system processes, and maintain appropriate security controls.

This position may require reviewing and analyzing sensitive and confidential information. The successful candidate must demonstrate a high level of professionalism, accountability, confidentiality, and security awareness and must be able to pass required fingerprint and background checks.

• Support our client's information security and Governance, Risk, and Compliance (GRC) activities.
• Assist with the development, review, and maintenance of security policies, procedures, standards, and compliance documentation.
• Support compliance activities related to federal information security requirements, applicable regulatory requirements, and the protection of Personally Identifiable Information (PII).
• Assist with NIST Special Publication 800-53 security controls and related control implementation requirements.
• Assist with security control assessments and documentation of control effectiveness.
• Participate in risk assessments, risk identification, risk analysis, and risk mitigation activities.
• Assist with the development and maintenance of System Security Plans (SSPs) and supporting security documentation.
• Assist with Plans of Action and Milestones (POA&Ms), including documenting identified weaknesses, corrective actions, responsible parties, milestones, and remediation status.
• Support continuous monitoring activities to identify changes in security posture, system risks, vulnerabilities, and compliance status.
• Assist with security audits, assessments, reviews, and security audit/evidence management.
• Collect, organize, validate, and maintain evidence required to demonstrate compliance with security controls and regulatory requirements.
• Support the assessment and documentation of hybrid controls, including controls involving cloud services, provided services, enterprise controls, external systems, and shared responsibilities.
• Coordinate with system owners, System Administrators, IT staff, vendors, and other stakeholders to obtain required security documentation and evidence.
• Monitor identified security findings and assist with tracking remediation activities through completion.
• Assist with documenting security risks and providing recommendations to management regarding risk treatment and remediation.
• Support reviews of system changes to determine potential security and compliance impacts.
• Maintain accurate security records, assessment documentation, and compliance artifacts.

• Assist with ongoing compliance monitoring to ensure applicable policies, procedures, security controls, and regulatory requirements remain current and effective.
• Support the review and updating of policies and procedures when security, technology, regulatory, or operational requirements change.
• Assist with updating policy and training materials to reflect current compliance and security requirements.
• Monitor security and compliance training completion and maintain appropriate documentation and records.
• Assist management with identifying training requirements based on security findings, policy changes, audit results, or regulatory requirements.
• Communicate security and compliance requirements to employees and stakeholders.
• Support security awareness activities related to the proper handling of sensitive…