The Security & Compliance Analyst supports the integrity, security, and compliance of systems and processes used to administer retirement benefits for public sector employees. This role ensures that technology solutions, operational practices, and policy implementations adhere to state regulations, security standards, and organizational governance requirements.
The analyst will collaborate with cross-functional teams to strengthen security controls, improve business processes, and ensure secure and reliable delivery of services to stakeholders and citizens.
Key Responsibilities
Analyze, document, and validate security processes, system requirements, and interagency interactions supporting retirement benefits administration.
Collaborate with program offices, technical teams, and subject matter experts to define security and compliance requirements for system enhancements, policy updates, and new initiatives.
Create and maintain audit-ready security requirements, user stories, workflows, use cases, and other documentation.
Support solution design and participate in testing, including UAT, to verify security controls and compliance requirements.
Recommend improvements to strengthen security posture, process efficiency, and program accountability.
Monitor project deliverables, timelines, and milestones to ensure alignment with security and compliance objectives.
Develop training materials and support security and compliance education for program staff and stakeholders.
Conduct gap analyses and assess impacts of legislative, regulatory, and policy changes.
Perform data analysis and generate reports for compliance monitoring, risk tracking, performance evaluation, and decision-making.
Leadership & Collaboration
Provide guidance and informal leadership to cross-functional teams on security, compliance, and risk management best practices.
Lead discussions with stakeholders and technology teams regarding security objectives and compliance expectations.
Mentor analysts on security frameworks, requirements documentation, and governance processes.
Promote security awareness and continuous improvement.
Lead key security and compliance initiatives and ensure deliverables meet organizational and regulatory standards.
Support security incidents, compliance issues, and audit activities by coordinating responses and communications.
Security & Compliance Support
Support internal and external security and standards reviews.
Conduct security risk assessments and recommend mitigation strategies.
Develop and maintain security documentation, including System Security Plans, Assessment Reports, and Authorization packages.
Support security audits by gathering documentation and demonstrating control effectiveness.
Disaster Recovery & Business Continuity
Collaborate with business units to develop and maintain Business Continuity Plans (BCPs).
Conduct business impact assessments and ensure DR/BCP strategies align with operational requirements.
Participate in tabletop exercises and simulations to validate recovery plans.
Identify, document, and address DR/BCP gaps.
Ensure DR/BCP activities align with NIST, FISMA, and applicable state policies and standards.
Contribute to Disaster Recovery Plan development, documentation, and testing.
Assist in defining Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
Vulnerability Management
Coordinate system, application, and network vulnerability scans with infrastructure and security teams.
Analyze vulnerability scan results and prioritize risks.
Support vulnerability mitigation planning and remediation activities.
Minimum Qualifications
7+ years of professional experience in security, compliance, risk management, or a closely related discipline within a government agency, public retirement system, or regulated financial environment.
Experience developing, documenting, and evaluating security controls, compliance requirements, and governance processes.
Experience supporting security/compliance assessments, audits, policy reviews, and control validations.
5+ years of experience with security and compliance frameworks such as NIST CSF, NIST 800-53, and state IT security standards.
Experience supporting system or process changes involving data protection, access controls, regulatory compliance, and secure implementation.
Knowledge of Agile SDLC practices with security and compliance integrated into requirements, testing, and release processes.
Ability to assess common application vulnerabilities, including XSS, CSRF, SQL Injection, and authentication weaknesses.
5+ years of experience with tools supporting security documentation, compliance tracking, and workflow management, such as Azure DevOps and GRC platforms.
Experience contributing to Disaster Recovery Plans and business continuity activities.
Preferred Qualifications
Bachelor's degree in Information Security, Cybersecurity, Information Systems, Public Administration, or a related field, or equivalent experience.
Experience supporting security and compliance for public pension or retirement administration programs.
Knowledge of security capabilities and data protection requirements within pension administration or enterprise benefits systems.
Experience with SQL, Power BI, advanced Excel, or other analytics tools for compliance monitoring, reporting, security metrics, and data validation.
Security or compliance certifications such as CGRC, CAP, Security+, CISA, or similar.
Knowledge of state and federal regulations related to data security, privacy, and compliance within public sector retirement systems.
Familiarity with Java or .NET.
High-level understanding of web application architecture and functionality.
