IT Security & Compliance Analyst

• Analyze, document, and validate security processes and system requirements supporting retirement benefits administration
• Define and refine security and compliance requirements for system enhancements and new initiatives alongside program offices and technical teams
• Create and maintain audit-ready documentation, including security requirements, user stories, workflows, and use cases
• Support solution design and UAT to verify security controls are properly implemented
• Monitor deliverables and timelines against security and compliance objectives
• Conduct gap analyses on legislative, regulatory, and policy changes and their operational impact
• Perform data analysis and reporting to support compliance monitoring and risk tracking
• Support security/standards reviews, risk assessments, and mitigation planning
• Contribute to System Security Plans, Assessment Reports, and Authorization packages
• Support Disaster Recovery and Business Continuity Planning, including business impact assessments and tabletop exercises
• Coordinate vulnerability scans and support mitigation planning
• Provide informal leadership and mentorship to fellow analysts on security frameworks and governance processes

• 7 years of professional experience in security, compliance, risk management, or a closely related discipline within a government agency, public retirement system, or regulated financial environment
• Demonstrated experience developing, documenting, and evaluating security controls, compliance requirements, and governance processes
• Experience supporting security/compliance assessments, audit activities, policy reviews, and control validations
• Working knowledge of security/compliance frameworks relevant to public sector environments (e.g., NIST CSF, NIST 800-53)
• Experience participating in system or process changes with a focus on data protection, access controls, and secure implementation
• Knowledge of Agile SDLC with an emphasis on integrating security/compliance into requirements, testing, and release
• Ability to assess common vulnerabilities (XSS, CSRF, SQL Injection, authentication weaknesses)
• Proficiency with tools supporting security documentation, compliance tracking, and workflow management (e.g., Azure Dev Ops, GRC platforms)
• Experience contributing to Disaster Recovery Plan development, documentation, and testing, including RTOs/RPOs
• Bachelor's degree in information security, cybersecurity, information systems, public administration, or related field (or equivalent experience) — preferred
• Experience supporting security/compliance needs within public pension or retirement administration programs — preferred
• Familiarity with security capabilities and data protection requirements within pension administration or enterprise benefits platforms — preferred
• Experience with SQL or analytics tools (Power BI, advanced Excel) for compliance monitoring and reporting — preferred
• Security/compliance certifications (CGRC, CAP, Security+, CISA, or similar) — preferred
• Knowledge of federal/state regulations governing data security and privacy in public sector retirement systems (IRS, SSA, audit standards) — preferred
• Familiarity with Java or .NET — preferred
• High-level understanding of web application functioning — preferred

Demonstrates expertise in security processes, compliance requirements, and risk management within public sector environments, with a strong focus on documentation, assessment, and governance. Proficient in integrating security controls into system enhancements and ensuring audit readiness.

• Security Compliance Frameworks
• Risk Management
• Audit Documentation
• Data Protection
• Disaster Recovery Planning

• Security Controls Development
• Compliance Requirements Evaluation
• Data Analysis
• Vulnerability Assessment
• SQL
• Agile SDLC
• User Acceptance Testing
• Security Documentation
• Workflow Management
• Gap Analysis

• Informal Leadership
• Mentorship

• CGRC
• CAP
• Security+
• CISA

• Public Sector
• Retirement Benefits Administration
• NIST CSF
• NIST 800-53
• Federal Regulations
• Data Security
• Privacy Standards
• Pension Administration

• Azure Dev Ops
• GRC Platforms
• Power BI
• Advanced Excel