Security Analyst

Madison, United States | Posted on 07/06/2026

Under the general supervision of the GRC Manager, this position serves as a Security Analyst responsible for supporting a wide range of compliance and cybersecurity functions across the Wisconsin Department of Correction (DOC). Core responsibilities include providing risk assessment and/or compliance support, leading audits, submitting findings, analyzing risks for specific areas, monitoring corrective actions, and drafting risk reports with metric charts and ongoing effort accountability.

The analyst will provide support in detecting, analyzing, and responding to cybersecurity threats, participating in forensic investigations, vulnerability management, cloud security initiatives, tabletop exercises, and security response procedures.

• Support cybersecurity policy execution, operational standards, and governance activities (60%)
• Review policy, procedures, controls, and standards to ensure DOC and regulatory standards are met (A1).
• Address compliance issues with IT security standards, identify deficiencies, and recommend control and risk mitigation measures (A2).
• Review documentation to ensure it meets standards and applicable regulatory requirements (A3).
• Assist with creation/revision of policy, process, and technical controls (A4).
• Report on risks and mitigations, and follow up to verify adjustments (A5).
• Interpret NIST or other standards to recommend and implement best practices (A6).
• Contribute to maintenance and operationalization of information security policies, procedures, and response playbooks (A7).
• Review new IT projects, systems, and vendor solutions for security risk, documenting and escalating concerns (A8).
• Provide technical consulting and security recommendations aligned with DOC standards and DOA/DET architecture (A9).
• Participate in enterprise-level risk assessments and contribute data to compliance, audit, or risk reporting needs (A10).
• Assist in threat modeling exercises or tabletop simulations (A11).
• Monitor, detect, respond to, and investigate cybersecurity threats across the DOC environment (20%)
• Triage, analyze, and respond to cybersecurity alerts using current technologies and tools (B1).
• Conduct forensic investigations into suspected security incidents, including phishing, account compromise, and endpoint breaches (B2).
• Coordinate with internal teams and DOA/DET to contain, eradicate, and recover from security incidents (B3).
• Analyze logs, threat intelligence, and user behavior to identify indicators of compromise and prevent recurrence (B4).
• Document incident response actions and create post‑incident reports with recommended improvements (B5).
• Participate in phishing mitigation, email threat response, and takedown coordination with third‑party providers (B6).
• Assist in vulnerability validation and risk triage based on vendor and tool security recommendations (B7).
• Support the tuning, configuration, and enhancement of security technologies used in DOC’s environment (B8).
• Assist with employee forensics, HR/legal investigations, and eDiscovery requests through log and artifact analysis (B9).
• Assist with continuous improvement of detection logic, alerts, and response workflows in current technologies and tools (B10).
• Contribute to the configuration, deployment, and lifecycle management of security technologies (15%)
• Collaborate with internal teams and DOA/DET to implement, monitor, and maintain endpoint security, network protection, and access control systems (C1).
• Assist in the deployment or refinement of security technologies and tools (C2).
• Test and validate new use cases or configurations in existing tools and platforms, reporting anomalies or conflicts (C3).
• Maintain technical documentation and inventories related to security tooling, integrations, and metrics (C4).
• Maintain current expertise in cybersecurity tools, trends, and techniques (5%)
• Participate in professional development opportunities such as conferences, technical training, and webinars (D1).
• Track emerging threats, vulnerabilities, and technology trends through vendor briefings, information sharing groups, and security communities (D2).
• Contribute to internal…