Job Ref:
10023703
Location:
Adelphi, MD
Category:
IT and Project Management
Type:
Full time
Senior Analyst, Information Security Risk & Compliance
Security Risk & ComplianceUS Exempt RegularFull timeStateside Exempt 4.2Location: Adelphi, MD (Hybrid)

SUMMARY:

The Senior Analyst, IS Risk & Compliance performs security risk assessments, audits, and/or inspections, of the computing environment for UMGC’s customers. The Senior Analyst, IS Risk & Compliance is responsible for delivering executing security assessments, promoting effective IT internal controls and risk management, and providing guidance to IT and business units on all aspects of internal & external audits, governance, and business process improvements.
Additionally, the Senior Analyst, IS Risk & Compliance key role is to provide an independent opinion on the suitability of the IT risk management framework and to provide objective assurance that the risks in the business are being appropriately managed and that controls are operating as expected. You will be responsible for implementing the assessment process, educating stakeholders, building partnerships , and socializing security best practices.

EXPERIENCE:

• 7+ years in IT audit.
• Strong understanding of the NIST 800 special publications (e.g. NIST 800-171, NIST 800-53, Risk Management Framework, etc) and DoD CMMC.
• Collaborating with IT and business stakeholders to plan the engagement and develop work program timelines, risk assessments and other documents/templates.
• Lead and execute IT audit engagements.
• Experience in applying relevant technical knowledge in the following engagements: (a) ITGC audits; (b) IT internal or operational audits; (c) Service Organization Controls (SOC) Reporting engagements; (d) ERP and cloud security reviews.
• Demonstrating and applying strong project management skills.
• Solid knowledge of and experience with secure web architectures, tools and processes.
• Experience auditing network designs, network Security, wireless Security, and client/server security.
• Knowledge of vulnerability assessment/network discovery and associated tools.
• Experience auditing networking technologies.
• Experience auditing applications.
• Enterprise aware (change control, downstream impacts, understanding of cause and effect, change windows, etc.).
• Must have the knowledge of IT security technologies such as firewalls, intrusion detections systems, antivirus, patch management, etc., and the interest and experience to work on security policy and architecture.
• Knowledge of various control and risk management concepts and methologies as well as knowledge and expertise of all applicable regulations and audit standards such as FERPA, PCI-DSS, and SSAE-16.
• Advanced understanding of IT general controls (e.g. security, change management, incident and problem management, disaster recovery, backup, data center, infrastructure, data protection etc.)
• Competent knowledge of IT and Information Security operations, policies and procedures in areas such as Windows Active Directory, Unix/Linux and databases. Knowledge of cloud architecture (Azure, AWS), operational frameworks and security controls would be beneficial
• Ability to identify issues and associated risks, and provide practical solutions to a wide range of audit issues
• Experience of an IT line role would be advantageous but is not essential
• Experience or aptitude for using data analytics tools and techniques in an audit role would be a distinct advantage
• Proficient in the use of Microsoft Office Word, Excel, PowerPoint
  Preferred Experience Requirements:

EDUCATION:

• Bachelor’s Degree

Skills:

• Demonstrated process improvement experience.
• Recognized as a strategic thinker and is results oriented.
• Demonstrated effective strong team player and self-motivator. Ability to work and interface internally with IT and other functional support groups with minimal guidance.
• Demonstrated successful experience in a customer-facing role.
• Excellent written and oral communication skills

• Planning, preparation and completion of the assigned audits to include assessing the effectiveness and compliance with policies, laws/regulations and best standards.
• You are also expected to conduct Kick-off Meetings, IT internal control testing, develop IT internal audit plans, conduct IT audit closure meetings and provide other IT internal audit services.
• Collaborate with departments to improve security compliance and manage technology risk.
• Assist in developing system security plans (SSPs) and ensure they meet NIST SP 800-171 control requirements and other required standards.
• Assist in developing and/or reviewing IT security policies.
• Provide corrective action support to include developing Plan of Actions and Milestones (POA&Ms), monitor milestones, and support completion of action steps for any deficiencies identified in systems.
• Strong understanding of various laws/regulations to include, but not limited to, CMMC, GLBA, FERPA, PCI-DSS, and GDPR and ability to execute audit plans to assess compliance.
• Able to identify relevant IT risks and to properly document the audit/assessment process, gaps, and remediation steps.
• Collaborates with business units to enhance IT security posture.
• Work closely with security operations team, server operations, network operations, and application teams and ensure security practices comply with applicable laws and regulations.
• Assess security products and effectiveness of various security products to include firewalls, intrusion detection systems, antivirus, patch management, etc.
• Review and provide input into network designs to ensure compliance with security and enterprise architecture.
• Provide input and visibility into emerging security technologies, deployment strategies and other security protocols to ensure awareness within the IT security branch.
• Review in-house and 3rd-party applications and code for security vulnerabilities and best practices.
• Develop and/or implement automated security assessment testing tools where possible.
• Act as a liaison to interpret external audit requests, describe what should be provided, and suggest possible options.
• Strong understanding of cloud (Azure) and network environments.

Skills:

• Demonstrated process improvement experience.
• Recognized as a strategic thinker and is results oriented.
• Demonstrated effective strong team player and self-motivator. Ability to work and interface internally with IT and other functional support groups with minimal guidance.
• Demonstrated successful experience in a customer-facing role.
• Excellent written and oral communication skills.

Education & Experience Requirements: