Business Analyst III (OPSR/LASO)

Help protect criminal justice information and build the security compliance program that supports the Travis County Sheriff’s Office. TCSO is hiring a full-time Business Analyst III to lead its local Criminal Justice Information Services (CJIS) security compliance program as designated Organizational Personnel with Security Responsibilities (OPSR), a function historically associated with the Local Agency Security Officer (LASO).

This dedicated role offers the opportunity to strengthen how the agency assigns security responsibilities, verifies safeguards, and follows compliance issues through to resolution. You will use your technical and analytical skills to evaluate systems and data flows, review security configurations and supporting evidence, prepare complete audit packets, and coordinate security incident reporting. You will also review the work of designated control owners and help turn security requirements into practical procedures.

Reporting to the Central Warrants Manager, you will work closely with TCSO’s Terminal Agency Coordinator (TAC), TCSO Technology, Travis County ITS and IT Security, the Facilities Management Department (FMD), the Texas Department of Public Safety (DPS), and other partners. This position is suited to someone who enjoys investigating complex issues, organizing detailed information, explaining technical requirements clearly, and working across organizations to get results.

Distinguishing Characteristics: This is the fourth in a series of four business analyst-related job classifications within the Information Technology job family. This assignment provides complex technical consulting, business process analysis, and oversight of the agency’s CJIS security compliance program. The OPSR leads security control coordination and verification and works with the TAC on related system access and operational requirements.

The employee must understand technical security concepts sufficiently to evaluate system documentation, configurations, access records, logs, and other evidence with TCSO Technology, ITS and IT Security. The position requires strong organization, attention to detail, independent judgment, and the ability to review others’ work objectively. The employee is accountable for documenting control ownership, monitoring compliance, preparing audit materials, and following deficiencies through to correction or management escalation.

Responsibilities involving supporting departments, vendors, and other partners are carried out within applicable agreements and assigned authority. This position requires independent judgment and ownership of assigned work. The employee is expected to evaluate information, apply established requirements, make and document decisions within delegated authority, and carry issues through to resolution. Matters requiring management action must be presented with the relevant facts, applicable requirements, available options, and a recommended course of action.

Examples of Duties Serve as TCSO’s designated OPSR and principal local contact for CJIS information security matters within the responsibilities assigned by the agency. Build and maintain a documented assignment of CJIS security control responsibilities. Identify required activities, proposed control owners, supporting personnel, required evidence, and review schedules. Obtain appropriate management approval for assignments and keep them current.

Audit the work and compliance evidence of designated security control owners and supporting personnel within the assigned scope. Coordinate reviews with Travis County ITS and IT Security, document deficiencies, and verify that corrective actions address the findings. Prepare and maintain complete, organized audit packets for CJIS technical security audits and related assessments. Assemble control documentation, supporting evidence, written responses, and corrective action records so materials are accurate, current, and readily retrievable.

Maintain a security compliance tracking system identifying control owners, required evidence, review schedules, findings, deadlines, and corrective action status. Follow up on missing or incomplete items and escalate unresolved issues. Maintain a documented inventory of systems, devices, connections, services, and supporting organizations that process, store, transmit, or provide access to criminal justice information within the assigned environment Review network and data flow diagrams, access and authentication settings, audit logs, configuration records, and other technical evidence with ITS and IT Security.

Assess whether the evidence demonstrates compliance and identify items requiring further review or remediation. Coordinate with ITS, IT Security, and responsible technical personnel to verify implementation and operation of applicable security measures, including access control, authentication, logging, configuration management, physical security, media protection, and incident response. Oversee compliance with applicable personnel screening and CJIS security training requirements for TCSO and supporting personnel within applicable agreements.

Coordinate screening processes and required approvals with responsible officials, maintain or verify documentation, and address access-related issues with the TAC. Review proposed applications, integrations, data exchanges, vendor services, and system changes with the TAC, TCSO Technology, ITS, and IT Security. Document the information involved, authorized users, connections, downstream recipients, storage, retention, and unresolved security requirements for agency review.

Review applicable agreements and documented responsibilities with ITS, IT Security, FMD, vendors, and other partners. Identify gaps between assigned responsibilities and actual practices and coordinate resolution through appropriate officials. Develop and maintain security policies and procedures for management approval. Coordinate implementation and confirm that documentation reflects actual practices. Coordinate CJIS security incident reporting and documentation with ITS, TCSO Technology, IT Security, the TAC, and other designated officials.

Ensure required notifications, including notifications to the DPS CJIS security contact when applicable, are made through established channels within required timeframes. Support incident follow-up with responsible technical and operational personnel. Document findings, track corrective action, and verify that identified compliance gaps are addressed. Monitor changes to the FBI CJIS Security Policy and applicable Texas DPS requirements and guidance, evaluate their effect on TCSO systems and procedures, and coordinate implementation with designated control owners.

Use spreadsheets, reporting tools, and compliance tracking systems to organize evidence, identify overdue requirements, analyze findings, and report program status. Provide the Central Warrants Manager with regular reports on control ownership, compliance status, audit readiness, open findings, corrective actions, and unresolved risks. Work with the TAC to coordinate overlapping access, training, audit, and incident matters, with documented responsibility for follow-up.

Respond to urgent after-hours security matters and ensure required incident reporting is completed outside regular working hours when necessary. Independently interpret network and data flow diagrams, system connections, access paths, authentication methods, and supporting technical documentation. Identify missing information, inconsistencies, and potential gaps in applicable security requirements. Evaluate technical explanations and evidence provided by system owners, ITS, IT Security, and vendors.

Determine whether the evidence supports compliance, request additional information when needed, and document the basis for findings. Make and document routine CJIS security compliance determinations within delegated authority. Identify deficiencies and required corrective actions, communicate them clearly to responsible personnel, and verify resolution. Present proposed exceptions, unresolved technical concerns, and decisions outside delegated authority to management with a documented assessment and recommended action.

Perform other job-related duties as assigned. Qualifications Education and Experience: Bachelor's degree in Computer Science, Information Systems, Business Administration or a directly related field AND five (5) years of relevant work experience; OR, Any combination of education and experience that has been achieved and is equivalent to the stated education and experience and required knowledge, skills, and abilities sufficient to successfully perform the duties and responsibilities of this job.

Licenses, Registrations, Certifications, or Special Requirements: Valid Texas Driver's License. Applicants are required to attach a resume with the online application. Preferred: Experience serving as a LASO, TAC, OPSR, or in a comparable information security compliance role. Experience applying the FBI CJIS Security Policy and applicable Texas DPS requirements and preparing for CJIS technical audits conducted by Texas DPS or the FBI.

Experience reviewing technical security evidence, including access permissions, authentication settings, system configurations, logs, and network or data flow documentation. Experience assigning security control responsibilities, preparing audit packets, reviewing others’ work, and managing corrective action. Experience reviewing applications, integrations, data exchanges, and vendor arrangements. Experience coordinating security requirements and incident response with IT departments, information security personnel, and multiple organizations.

Knowledge, Skills, and Abilities: Knowledge of: The FBI CJIS Security Policy, applicable Texas DPS requirements, and local information security responsibilities. Security control assignments, compliance evidence, risk assessment, audit preparation, and corrective action. User and privileged access, authentication, audit logging, system configuration, and network security concepts. Personnel screening, security training, physical security, media protection, and incident reporting.

Information systems, network connections, data flows, and technical documentation. Security considerations for applications, integrations, vendor services, and information sharing. Business analysis, process documentation, and change management. Skill in: Evaluating technical and operational evidence against written security requirements. Interpreting system configurations, access records, logs, and network or data flow diagrams in coordination with technical personnel.

Using spreadsheets, reporting tools, and compliance tracking systems to organize evidence and identify exceptions. Documenting control responsibilities, findings, decisions, and corrective actions. Managing compliance activities and deadlines across multiple responsible teams. Explaining security requirements to technical staff and nontechnical decision-makers. Writing clear policies, procedures, assessment findings, and management reports.

Ability to: Learn and use technical systems and tools relevant to security assessment and compliance. Maintain a high level of organization and attention to detail while collecting documentation from multiple sources and producing complete, accurate audit packets. Make timely, well-supported decisions within established policies, agreements, and delegated authority. Resolve routine matters independently and escalate exceptions, material risks, conflicting requirements, or decisions outside assigned authority.

Evaluate others’ work objectively, explain deficiencies clearly, and follow through on corrective action. Establish effective working relationships with the TAC, ITS, IT Security, FMD, and external partners. Identify gaps in technical evidence and obtain the information needed to assess compliance. Handle sensitive criminal justice and security information appropriately. Coordinate effectively during incidents, maintain accurate documentation under time pressure, and promptly escalate unresolved risks.

Supplemental Information Physical requirements include the ability to lift/carry up to 35-40 pounds occasionally, visual acuity, speech and hearing, hand and eye coordination and manual dexterity necessary to operate a computer and office equipment. Subject to standing, sitting, walking, climbing, crawling, bending, stooping, crouching, kneeling, pushing, pulling, reaching, twisting, balancing, repetitive motion, and squatting to perform the essential functions.

Subject to exposure to variations in extreme heat, cold, mechanical, fume/odor, and dust/mites. Travis County employees play an important role in business continuity. As such, employees can be assigned to business continuity efforts outside of normal job functions. Work Hours: 8 am - 5 pm, Monday-Friday. Requires telephone response to after-hour emergencies and possibly in-person response if deemed necessary. Location: Austin TX Department: Sheriff Criminal, Driving, Education, and Employment Background Checks Required.

Drug Test Required. For updates or questions on this position, contact: [email protected] This job description is intended to be generic in nature. It is not necessarily an exhaustive list of all duties and responsibilities. The essential duties, functions and responsibilities and overtime eligibility may vary based on the specific tasks assigned to the position.