Security and Governance Analyst

About the Role: The Security & Governance Analyst works within Technology Operations to maintain Michigan Virtual’s systems and data, ensuring that technology, including AI and automation, is adopted securely, responsibly, and in compliance with organizational standards. Spanning day-to-day security operations and AI governance review, this role serves as the checkpoint between development and approval of AI and automated solutions before release and throughout their lifecycle, working in collaboration with the AI, Automation & Governance Manager, the AI & Automation Specialist, the Managed Service Provider, and teams across the organization to keep security and governance practical and well-documented., Security Monitoring & Analysis

• Monitor and advise on information security issues affecting internal systems and workflows to ensure appropriate security controls are in place.
• Review and analyze logs (IDS, firewalls, identity, and cloud services) to identify threats and vulnerabilities, and implement corrective actions.
• Conduct security assessments of systems, workflows, and applications and stay current on security issues, emerging threats, best practices, and trends.

Incident Response

• Support incident response activities, including investigation, containment, documentation, resolution, and post-incident review.
• Work with the Managed Service Provider (MSP) to identify, triage, and escalate security incidents, including reviewing alerts and monitoring data, determining severity and scope, and coordinating containment and response actions.
• Maintain incident records and lessons learned, and recommend improvements to response procedures.
• Provide technical support for security-related issues from end users.

Vulnerability Management & Compliance

• Perform vulnerability assessments, coordinate corrective actions (patching, removals, updates) with the MSP and IT teams, and track them to completion.
• Support implementation and maintenance of CIS Controls and all other security initiatives.
• Conduct scheduled audits to maintain compliance with security policies, and document findings and remediation.

AI Request Review & Governance Support

• Perform intake triage for AI and automation requests, including risk assessment based on data sensitivity, system access, and impact.
• Conduct security, privacy, and vendor reviews of tools, automations, and other new applications before adoption and periodically afterward, covering data handling, access and permissions, vendor security, and FERPA and data privacy obligations.
• Review AI and automation solutions before production release and verify that access controls and logging are in place.
• Assist with building and maintaining the AI tool and automation inventory and the supporting review records, including purpose, data sources, owners, vendors, risk assessments, and review dates.
• Support the development and maintenance of AI governance policies, standards, and review procedures, and report on compliance, exceptions, and risks.

Other Duties

• Conduct user security training using existing training tools to promote a security-conscious culture.
• Contribute AI security and responsible-use guidance to staff training in partnership with the AI, Automation & Governance team.
• Collaborate closely with the MSP, leadership, and other teams to implement and uphold security practices and standards.
• Clearly communicate security risks, review outcomes, and report compliance status to the Manager and stakeholders.
• Maintain documentation of security systems and procedures, including knowledge base articles for security-related topics.
• Use Wrike to manage tasks, projects, and recurring security and review processes.
• Complete professional development opportunities that strengthen skills and benefit Michigan Virtual.

Security Analysis, Time Management, Automation, Technical Operations, Artificial Intelligence (AI), Virtualization, Security Analysis, Regulatory Compliance, Risk Analysis, Nonprofit, * Hands-on experience in security operations, such as monitoring, log analysis, vulnerability management, and incident response.

• Working knowledge of security frameworks and controls (such as CIS Controls or NIST).
• Experience conducting risk, vendor, or compliance reviews and documenting findings and decisions.
• Working knowledge of data privacy, FERPA, and responsible use of technology, including the risks of AI tools.
• Familiarity with identity and access management concepts, such as role-based access, single sign-on, and least privilege.
• Experience with Microsoft 365, Entra ID, and endpoint management tools preferred.
• Strong judgment and the ability to balance security and compliance with the needs of the teams being supported.
• Clear written and verbal communication, including the ability to explain security and compliance topics to non-technical audiences.
• Ability to manage competing priorities, * Bachelor’s degree in information technology, cybersecurity, computer science, or a related field, or equivalent experience.
• Three or more years of experience in information security, IT compliance, risk, or a related field.
• Security certification (such as Security+, CySA+, CCST, or similar) required.

Work Environment and Physical Demands

• Open office environment with occasional distractions.
• Noise level is usually low to moderate.
• Extended periods of sitting or standing at a computer.

Michigan Virtual is a Lansing-based nonprofit 501(c)(3) organization dedicated to advancing education through research, innovation, policy, and digital learning solutions.

Our mission is to maximize learning and teaching by bringing together the best in people and technology.

Our vision is to be Michigan’s leader in innovation in education.

We serve over 300 full- and part-time employees who are passionate about making a difference for students, educators, and families across Michigan., * We believe in a culture of caring. At Michigan Virtual, every team member is welcomed, heard, and valued.

• Our monthly Culture Committee creates opportunities for connection, reviews staff feedback, and champions a positive workplace.
• We emphasize professional growth and continuous learning for all of our employees.
• Our highly collaborative workplace fosters opportunities to use your unique skills, abilities and perspectives in service of our partners and constituents.

Work That Makes a Difference. Culture That Makes It Possible.