Security Analyst; Third-Party Risk Management); Part-time​/Remote

This opportunity is not open to C2C relationships or visa sponsorship.

Solu is seeking a Security Analyst for a part-time, fully remote role supporting the Ohio Department of Public Safety. This position offers flexible scheduling, allowing work to be completed at any time, including nights and weekends. The role requires a commitment of approximately 10 hours per week focused on analyzing security posture ratings and communicating findings.

In this role, the Security Analyst will function as a part-time Cyber Security Consultant responsible for reviewing third-party security assessments, monitoring vendor security ratings, and supporting compliance oversight for online driver training organizations. The Department of Public Safety will provide access to the Third-Party Risk Management (TPRM) tool Bit Sight and the assessment communication platform One Trust to support analysis, reporting, and communication of security findings.

• Review initial security assessment provided by online driver training companies at the time of application. DPS to provide the security assessment questionnaire. Security Consultant to validate the security assessment is accurately and thoroughly completed.
• Review updated security assessment provided by online driver training companies for submission of changes of security controls.
• Document and address concerns or clarifications needed for the security assessment review with the online driver education companies:
  Security Consultant to compare responses against the assessment and industry standards.
• Review online driver training company annual attestations of compliance. Security Consultant to validate the security assessment is accurately and thoroughly completed. Security Consultant to communicate any deficiencies in annual attestation to the online driver training company and facilitate the accurate completion of the attestation of compliance.
• Contact and work with Bitsight to configure monitoring parameters. Use Bitsight functionality to direct the findings and remediation recommendations to the online driver training company.
• Discuss findings with online driver training company:
  Security Consultant will use One Trust as the Governance Risk and Compliance GRC tool to assess and communicate. Security Consultant does NOT assist the online driver training company determine corrective path of action.
• Upon complaint for investigation including but not limited to reviewing updated monitoring results to confirm no falsification or other violation has occurred.
• Run Bitsight reports and provide the information the business needs for administrative action. Communicate with DPS Driver Training Program Office on a consistent basis with status updates.
• Monitor upcoming changes to the controls and communicate with the Driver Training Program Office with the specifics.
• May need to provide testimony at administrative hearings. Any testimony is based on processes and expertise on security controls if needed.

• Required 3 years:
  Experience with Cybersecurity frameworks (NIST CSF, ISO 27001), Third-party risk assessment, Vendor Management, Data Privacy.
• Required 3 years:
  Vulnerability management experience.
• Required 3 years:
  Utilize Bitsight security ratings to assess driving school security posture.
• Required 3 years:
  Daily or weekly tracking of vendor security ratings in Bitsight to detect drops in security performance.
• Required 3 years:
  Generate automated reports and dashboards for business highlighting provider risk exposure and their security control effectiveness.
• Required 3 years:
  Manage remediation plans within the GRC One Trust to closure.