Enterprise GRC Analyst

*** IMPORTANT ***

You must be eligible to work in the U.S. without sponsorship (U.S. citizens or green card holders only)

You must live within commuting distance of downtown Columbus, Ohio.

Organization Summary

FCDC provides cost-effective, business-driven, collaborative, and secure IT services and solutions to public service agencies throughout Ohio’s most dynamic county. Our goals are simple, but expansive: to be the most trusted enterprise technology service provider for Franklin County and a national leader in digital government services. Every day the FCDC team empowers local government departments, agencies, teams, and nonprofits to deliver top-notch services to residents and businesses in central Ohio, and we take pride in the work they accomplish with our support.

Job Summary

The Enterprise Security GRC Analyst supports the governance, risk, and compliance (GRC) program for the Franklin County Data Center (FCDC) and the county agencies it serves. The role covers four areas: third-party risk management, including security reviews of hardware and software procurements and renewals; security awareness, including tabletop exercises, security awareness training, and simulated phishing campaigns; information security policy and governance; and aligning FCDC and the county to the NIST Cybersecurity Framework (CSF) 2.0 as part of compliance with Ohio Revised Code (ORC) 9.64, enacted by House Bill 96.

The analyst reviews vendor products, services, and documentation, identifies and measures the risks they carry. Reports those risks with recommendations to mitigate them to FCDC leadership, partners, and vendors. The analyst also gathers technical and business needs from county agencies and FCDC teams and helps turn them into policies, standards, and governance. The GRC Analyst helps measure and improve the county’s cybersecurity program against NIST CSF 2.0 and the requirements of ORC 9.64.

New employees or those promoted into new positions at FCDC must successfully complete a 180-day probationary period and adhere to current Employee Handbook policies.

Requirements

Essential Duties and Responsibilities

To perform this job successfully, candidates must be able to perform each essential duty and fulfill each responsibility to a satisfactory degree. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. The essential duties and responsibilities include:

Vendor and Third-Party Risk Management

·Conduct security reviews of new hardware and software procurements for FCDC and county agencies, including SaaS and cloud services, on-premises software, and network, endpoint, and connected devices

·Conduct security reviews of hardware and software renewals, reassessing the vendor’s security posture, changes in scope or data handled, and any open findings before the renewal is approved

·Review vendor responses and documentation (security questionnaires, SOC reports, certifications, architecture and data flow information), document controls in place and controls not in place, and engage the vendor, business contact, and leadership as appropriate to complete the assessment

·Serve as primary point of contact for vendors on security questionnaires, responses, and documentation

·Review, document, track, and collaborate on remediation of third-party deficiencies

·Work with procurement, finance, and agency contacts so security review is built into purchasing and renewal workflows and completed ahead of contract deadlines

·Recommend updates to vendor security assessment procedures, forms, RFI/RFP security requirements, questionnaires, security contract language templates, and vendor risk reporting and metrics

·Provide recommendations for vendor security scoring and help develop metrics for measuring the success of the Third Party Risk Management program

·Execute recurring assessments and continually improve the accuracy, depth, and efficiency of the Third Party Risk Management program through tools and processes

·Act as Third Party Risk Management advisor on projects

·Ensure data loss prevention requirements and recommendations are incorporated into the vendor risk assessment process, partnering with the Data Loss Prevention Engineer

Security Awareness, Training, and Exercises

·Assist in planning, conducting, and evaluating tabletop exercises for FCDC and county agencies, including scenario and inject development, facilitation support, note-taking, and after-action reports and improvement plans

·Run assigned portions of tabletop exercises, such as individual modules, scenario segments, or participant groups, taking on larger portions as experience grows

·Support the security awareness training program, including content selection and development, assignment, completion tracking, and reporting, so employees receive cybersecurity training suited to their job duties as ORC 9.64 requires

·Plan, run, and report on simulated phishing campaigns, including template selection, targeting, results analysis, and follow-up training for users who need it

·Track awareness training and phishing metrics and trends and report them to FCDC leadership and partner agencies

Policy, Standards, and Governance

·Assist in writing, reviewing, and maintaining information security policies, standards, procedures, and guidelines

·Gather technical and business needs from county agencies and FCDC teams, and help develop the policies, standards, and governance processes that address them

·Coordinate stakeholder review of draft policies and standards with FCDC and agency contacts

·Evaluate and make recommendations on exceptions to security policy and standards, and track approved exceptions and compensating controls

·Assist in defining business processes and controls around sensitive data and applications to ensure compliance with financial, privacy, and other security and regulatory requirements

·Monitor and coordinate compliance activity with information security policies

NIST CSF 2.0 Alignment and ORC 9.64 Compliance

·Help align FCDC and county agencies to NIST CSF 2.0 as the basis of the county’s cybersecurity program under ORC 9.64 (House Bill 96)

·Assist in developing and maintaining NIST CSF 2.0 current and target profiles, mapping existing controls, policies, and processes to CSF Functions, Categories, and Subcategories, and identifying gaps

·Track gap remediation and maintain the documentation and evidence that show the cybersecurity program meets ORC 9.64 requirements

·Collaborate with auditors and assessors to provide evidence of compliance with ORC 9.64, FTI, CJIS, HIPAA, and other applicable requirements

·Monitor legislative and regulatory changes that affect the county’s cybersecurity obligations and recommend updates to processes and policy

General

·Assist as needed in Incident Response (IR) in the event of a breach, intrusion, or theft by providing security capability expertise

·Assist as needed in Disaster Recovery (DR) activities in the event of a disruption, outage, or disaster by providing security expertise and support to restore critical systems and services

·Respond to and assist with security events during non-traditional hours as needed

Note: Levels 1, 2, and 3 are distinguished by specific measures of performance, education, and experience. The tables below outline standard boundaries between each of the levels. Keep in mind that years of service alone is not sufficient justification for promotion. An employee must demonstrate consistent next-level performance to become eligible for promotion.

POSITION DETAILS

Role Summary

Supporter

Administrator

Designer / Project Manager / Mentor

FLSA Status

Exempt

Department / Reports to

Enterprise Information Security Manager

On-Call Responsibilities

Supports major (P1/P2) support events as required

BASELINE REQUIREMENTS

Enterprise Security GRC Analyst 1

Enterprise Security GRC Analyst 2

Enterprise Security GRC Analyst 3

Technical Skills

• ·Ability to convey security capabilities in business terms
• ·Working knowledge of FTI, CJIS, HIPAA, and Privacy regulations
• ·Successfully analyze data for the purpose of attaining business context
• ·Ability to assess the potential risk of an escalated issue and use business skills to evaluate impact and alternatives
• ·Basic understanding of information security controls, how they are used to detect and respond to, how they impact the business, and how gaps can be mitigated/remediated
• ·Understanding of enterprise technology infrastructure solutions
• ·Ability to create, modify, and maintain the vendor questionnaires within the Third Party Risk Management solution
• ·Understanding of security incident response handling procedures, incident management, and incident remediation
• ·Strong written communication skills for policy writing and training materials development.
• ·Strong verbal skills to effectively communicate metrics with business context.
• ·Understanding of facilitation techniques to be leveraged for trainings and cyber simulations.
• ·Working knowledge of NIST CSF 2.0 and CIS Controls, and of the cybersecurity program requirements of ORC 9.64
• ·Basic understanding of phishing and social engineering techniques and of security awareness program practices
• ·Ability to perform security reviews of hardware and software procurements and renewals using established procedures
• All items from Level 1, plus…
• ·Ability to train on security capabilities in business terms
• ·Understanding of and ability to articulate security frameworks (NIST CSF, CIS..)
• ·Assemble metrics to evidence Third Party Risk Management service effectiveness and performance
• ·In depth knowledge of enterprise technology infrastructure solutions available and applicability as a compensating control
• ·In depth knowledge of FTI, CJIS, HIPAA, and other data Privacy regulations
• ·Deep understanding of information security controls, how they are used to detect and respond to, how they impact the business, and how gaps can be mitigated/remediated
• ·Ability to administer the Third Party Risk Management solution
• ·Ability to take legislative changes and modify workflows to meet compliance or notify where compliance is not met within the Third Party Risk Management solution.
• ·Working knowledge of security incident response handling procedures, incident management, and incident remediation
• ·Understands and can apply change management concepts
• ·Ability to run simulated phishing campaigns and security awareness training assignments end to end and report on results
• ·Ability to facilitate portions of tabletop exercises and draft after-action reports and improvement plans
• ·Ability to map controls, policies, and processes to NIST CSF 2.0 and identify gaps
• ·Ability to translate technical and business needs gathered from stakeholders into draft policies and standards
• All items from Levels 1 and 2, plus…
• ·Ability to develop materials and train on security capabilities in business terms
• ·In depth knowledge of security incident response handling procedures, incident management, and incident remediation
• ·Proven ability to document and present complex processes to business audience
• ·Design metrics to evidence Third Party Risk Management service effectiveness and performance
• ·Develop ongoing strategy for the evolution of the Third Party Risk Management solution
• ·Contribute to the development of the ongoing strategy for the evolution of the Third Party Risk Management program
• ·Ability to take legislative changes that impact third party risk management program and recommend changes in process and strategy
• ·Ability to design and lead tabletop exercises using HSEEP or similar methodology
• ·Ability to develop and maintain NIST CSF 2.0 current and target profiles and lead gap remediation planning across FCDC and county agencies
• ·Ability to author new security policies and standards and lead them through stakeholder review and approval
• ·Ability to design the security awareness and simulated phishing program strategy and measure its effectiveness
• Language and Presentation Abilities
• ·Ability to read, analyze, and interpret general technical documentation.
• ·Ability to effectively respond to standard requests from end users and peers.
• ·Ability to write clear technical documentation for end users, peers, and client IT contacts.
• All items from Level 1, plus…
• ·Ability to prepare and present technical concepts and information to FCDC technical and business peers and client IT contacts.
• All items from Levels 1 and 2, plus…
• ·Ability to prepare and present technical and IT strategic concepts and information to client decision-makers and the public.

Physical Demands

• The physical demands described here are representative of those required to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities.
• ·Employees are regularly required to sit and talk or hear, sometimes for an entire work day.
• ·Employees are frequently required to use hands to finger, handle, or feel and reach with hands and arms.
• ·Employees are often required to stand, walk, stoop, kneel, crouch, and/or crawl.
• ·Some work is performed in networking and communication rooms, server rooms, or other areas that require the ability to maneuver within tight spaces while surrounded by IT equipment.
• ·Employees must occasionally lift and/or move up to 20 pounds, often without assistance.
• ·Employees must have vision abilities including the ability to adjust focus and view computer screens for entire work days while creating or consuming detailed information.

Enterprise Security GRC Analyst 1

Enterprise Security GRC Analyst 2

Enterprise Security GRC Analyst 3

Education Level/Work Experience

• NOTE: Relevant work experience years can be converted to formal education years at a ratio of 2:1 OR General IT support and/or system administration work experience years can be converted to network engineering experience years at a ratio of 4:1
• Preferred: Associates or bachelor’s degree or equivalent industry experience
• Required: High school diploma or equivalent
• Preferred: 3 years of information security experience
• Required: 2-year information security experience
• Preferred: Associates or bachelor’s degree and/or CISSP, CISM or SSCP
• Required: Associates or bachelor’s degree or equivalent industry experience
• Preferred: 3-5 years information security experience, 1 years working in vendor management
• Required: 3 years of information security experience
• Preferred: Bachelor’s degree and/or CISSP, CISM or SSCP
• Required: Associates degree and/or CISSP, CISM or other industry specific certification
• Preferred: 7 years information security experience, 3 years working within vendor management
• Required: 5 years information security experience, 2 years working in vendor management

Certification

• Preferred: One or more relevant and recent IT security certification from major manufacturers and/or testing services; Security+, Any ISC2 / ISACA certification
• Required: None
• Preferred: One or more relevant and recent IT security certification from major manufacturers and/or testing services; 3-5 years information security experience, 1 years working in vendor management
• Required: Security + or any ISC2 / ISACA certification in progress
• Preferred: CISSP, CISM or SSCP
• Required: Security + or any ISC2 / ISACA certification

INTELLECTUAL ABILITIES

Enterprise Security GRC Analyst 1

Enterprise Security GRC Analyst 2

Enterprise Security GRC Analyst 3

Decision Making / Problem Solving

• ·Makes sound, well-informed, and objective decisions in a timely manner.
• ·Compares data, information, and input from a variety of sources to draw conclusions; takes action that is consistent with available facts, constraints, and probable consequences.
• ·Applies both rational and creative processes to identify unknown root causes of problems.
• ·Based on the situation, decides best course of action, implements the solution, and follows-up to see how it’s working.
• ·Calculates and evaluates the long-term consequences of a decision.

Communication

• ·Clearly conveys and receives information and ideas through a variety of media to individuals or groups in a manner that engages the listener, helps them understand and retain the message and invites response and feedback.
• ·Keeps others informed as appropriate.
• ·Demonstrates effective written and verbal skills.
• ·Uses keen active listening skills to gather and validate information, to build trust, and enhance collaboration.

SOCIAL SKILLS

Enterprise Security GRC Analyst 1

Enterprise Security GRC Analyst 2

Enterprise Security GRC Analyst 3

Trust Development

• ·Gets along with others
• ·Acts with dignity and integrity
• ·Earns and maintains trust and support of supervisors
• ·Builds trust with client end users
• All items from Level 1, plus…
• ·Earns and maintains trust and support of peers within the organization for technical solutions
• ·Builds trust with client IT, project, and support contacts
• All items from Levels 1 and 2, plus…
• ·Earns and maintains trust and support of leaders across the organization for technical ideas and solutions
• ·Builds trust with client leaders

Self + Stress Management

• ·Maintains effective performance under pressure; handles stress in a manner that is acceptable to others and to the organization
• All items from Level 1, plus…
• ·Stays calm and even-tempered when handling crises, stressful situations, continuous change, or unexpected developments.
• ·Handles increased pressure and growing responsibilities
• All items from Levels 1 and 2, plus…
• ·Rapidly recovers from difficult situations; deals constructively with adversity
• ·Acts as a settling or calming influence in a crisis.

Teamwork

• ·Works effectively in a team environment to accomplish organizational goals.
• All items from Level 1, plus…
• ·Participates as an active and contributing member of project and cross-functional teams aligned with organizational goals.
• ·Actively shares information via documentation, project updates, and occasional team presentations.
• ·Highlights team accomplishments and ensures credit is distributed broadly across the team
• All items from Levels 1 and 2, plus…
• ·Helps create and maintain strong morale and a feeling of belonging in his/her team.
• ·Acts as if "true success" is the success of the whole team.

Conflict Management

• ·Uses appropriate interpersonal styles and techniques to reduce tension and/or conflict between two or more people; able to size up situations quickly; able to identify common interests; facilitates resolution.
• ·Steps up to conflicts and sees them as opportunities.
• ·Finds common ground and achieves cooperation without disruption to work flows or interpersonal relationships.

Inclusion

• ·Values an inclusive organization where the differences of all people are respected, valued and utilized towards achieving common goals.
• ·Respects and relates well to people from varied backgrounds, understands diverse worldviews, and is sensitive to group differences; sees diversity as an opportunity, respectfully challenges bias and intolerance.
• ·Supports equal and fair treatment.

DRIVE

Enterprise Security GRC Analyst 1

Enterprise Security GRC Analyst 2

Enterprise Security GRC Analyst 3

Work Ethic

• Does what it takes to get the job done; puts in extra hours as needed to ensure support tasks are complete and fully documented
• Does what it takes to get the job done; puts in extra hours as needed to ensure day-to-day administration and project tasks are complete, documented, and status is communicated
• Does what it takes to get the job done; puts in extra hours as needed to ensure designs are detailed and thorough and projects run well; also ensures teammates are getting what they need for projects and mentoring
• Dependability and Reliability
• ·Personally responsible
• ·Completes work in a timely and consistent manner
• ·Demonstrates regular and punctual attendance; arrives prepared for work
• ·Diligently follows through on commitments and consistently meets deadlines

Summary

FCDC BENEFITS

Medical, Dental, Vision and Behavioral Health, and Prescription Drug Coverage

Employee Assistance Program

Disability and Life Insurance

Ohio Public Employees Retirement System (OPERS)

Deferred Compensation

Generous Paid Time Off Accrual

Eleven Paid Holidays

Tuition Reimbursement

Company-Paid Training and Development

Commuter Program

The Franklin County Data Center is an Equal Opportunity Employer.