Information Security Analyst

Job Purpose:The Information Security Management (ISM) Office is responsible for ensuring the security of IT assets and systems within the Department. A key component of that is done by initiating and analyzing system security risk assessments. This position supports the System Security Risk Assessment and Risk Management function of the Florida Department of Transportation. These functions are described in The Florida Cybersecurity Standards, F.A.C. 60GG-2. Under direction of the ISM, this position will be responsible for coordination and guiding completion of the system security review assessment process; supporting the Risk Steering Workgroup; working with the ISM to develop the process for third-party vendor risk assessments; and once the process is developed - coordinating and guiding completion of third-party vendor risk assessment. The candidate must have an understanding and/or experience with risk and compliance work - including identifying the appropriate standards set, assessing if a system meets standards, and then documenting and communicating the concerns to the System Owner/System Coordinator. The goal of this process is to identify security controls that would be most appropriate for a system based on the security risk the system poses. This position is not expected to be a technical expert in security controls for systems; but is expected to understand general information technology concepts that would allow them to grasp and advance the process and goals, as well as become more knowledgeable of security controls over time.This position will also assist the ISM in expanding and formalizing the risk management function, which includes Developing and maintaining a risk register; proactively tracking and documenting risk and presenting it to the Risk Steering Workgroup for review and appropriate action. Communication is critical to this position. This position must be able to explain this process to System Developers, System Owners, and Project Managers so that they understand the importance of the risk reviews. This position must be able to communicate risk issues to business staff at all levels of the organization. This position must be a champion for this process and should proactively create marketing material regarding the process for review. This position will also assist the ISM in expanding FDOT’s third-party risk assessment program, and risk escalation/risk steering workgroup. Documentation of policies, procedures, user instructions, etc. will be required of this position.Must have strong organizational and project management skills and excellent writing and editing skills. Must understand risk-based decision making. Must be self-directed, professional, and willing to take ownership of this important process. Primary Job Duties/Tasks:Duties and Responsibilities will include but are not limited to:1. Initiate System Security Risk Assessments on systems being implemented within the Department. This includes systems written by FDOT staff/consultants, commercial off the shelf (COTS) systems or Software as a Service (SaaS) offerings.2. Develop and use reports and metrics to identify a risk-based approach to addressing systems that have not undergone a system security risk assessment. 3. Keep track of status and ensure progress of system security risk assessments.4. Work with ISM Team to develop Policies, Procedures and Guidelines supporting the Risk Assessment process.5. Perform Quality Assurance of submitted risk assessments prior to review by Security Analysts.6. Translates technical and/or complicated information related to the system security risk management process into clear, concise documents appropriate for various target audiences.7. Research, learn and understand the chosen SaaS platform and be able to educate end users including ISM Team Members, Project Managers, and others.8. Serve as the primary point-of-contact on the effort to move from existing system security risk assessment process to the new SaaS system.9. Gather and document business and technical requirements, which lead to improved Security policies, procedures, and products within the Department. About the Candidate: