Systems Security Analyst #00255

The Library of Virginia seeks a versatile and motivated Systems Security Analyst to support the operational, technical, governance, and compliance activities necessary to protect the agency’s information systems, networks, applications, cloud environments, and data assets. The ideal candidate will possess strong analytical, organizational, problem-solving, and communications skills. They will have strong troubleshooting skills, the ability and desire to learn new technologies quickly, and experience working in partnership with technical and non-technical staff.

This newly created role will review, update and administer our security monitoring and incident tracking procedures. The incumbent of this position will also manage and examine system security logs proactively, timely, and provide effective responses to potential issues and collaboratively work to transform data security practices at a 200-year-old cultural heritage organization and state agency with an eye towards the future.

Specifically, the Systems Security Analyst will be responsible for performing duties such as, but not limited to providing security design guidance for agency projects; assisting with conducting disaster recovery and business continuity planning and cybersecurity training; creating departmental efficiencies; improving security information gathering and response; coordinating remediation activities and validating corrective actions; and elevating governance, risk assessment and compliance procedures concerning Information system security. This position will serve as backup to the Information Security Officer during absences or delegated assignments.

• Experience demonstrating broad knowledge of cybersecurity principles, frameworks and best practices, including state and federal standards.
• A work history demonstrating experience in vulnerability management, incident response, audit coordination, and risk management methodologies.
• Experience conducting risk assessments and security control evaluations.
• Experience monitoring and assessing security alerts, incidents, vulnerability scans, security logs, and threat intelligence.
• Experience developing and maintaining IT security policies, standards, procedures, metrics, and supporting documentation.
• Experience demonstrating the ability to orally communicate technical concepts and conduct security awareness and role-based cybersecurity training with non-technical audiences.
• Experience coordinating internal and external audit responses and remediation tracking.
• Experience coordinating remediation activities with system administrators, developers, vendors, business stakeholders, and validating corrective actions and tracking remediation activities to closure.
• Experience supporting endpoint, network, identity, application, and cloud security controls.
• Experience demonstrating knowledge of and familiarity with artificial intelligence, governance and emerging technology risk.
• Experience demonstrating the ability to manage multiple priorities and work independently as well as collaboratively as part of a team.

Additional Considerations

• Course work in cybersecurity, information systems, computer science, or related field desired.
• Professional certifications such as Security+, CISSP, CISM, CRISC, GISP, GCCC, or similar credentials desired.
• Experience providing support and compliance with Commonwealth security standards, policies, and procedures including SEC530.
• Knowledge of security standards such as NIST Cybersecurity Framework, NIST SP 800-53, and CIS Controls desired.
• Considerable experience supporting audit remediation, information security, risk, compliance, and enterprise cybersecurity initiatives desired.
• Considerable experience developing and delivering security awareness and role-based cybersecurity training.
• Experience with Microsoft 365, Azure, and cloud security technologies desired .