Senior IT Security and Compliance Analyst

Come, Innovate, Build, Disrupt & Thrive!

Position Overview

KēSTA I.T. is seeking a Senior IT Security and Compliance Analyst to serve as a senior resource and compliance authority for a public-sector technology organization. This role supports multiple agency business areas and focuses on System Security Plans (SSPs), Disaster Recovery Plans (DRPs), and Authority to Operate (ATO) renewals.

The position acts as the liaison among business partners, technical teams, security groups, and management, making sure requirements, processes, and documentation align with state standards, NIST protocols, and enterprise security governance. The analyst guides stakeholders through complex compliance cycles and promotes consistency across application areas.

In addition to internal teams, the analyst works with vendors, auditors, project managers, and other analysts. The role also serves as an incident response specialist, leading mid- to high-level incident response and contributing to cyber event detection, correlation, response, and recovery.

Success in this role means current, accurate security documentation, valid ATOs maintained on a three-year cycle, tracked and closed remediation items, and clear reporting to management on risk.

Key Responsibilities

• Provide leadership and oversight for maintaining and updating System Security Plans (SSPs), ensuring accuracy, completeness, and alignment with NIST protocol and state compliance standards.

• Lead and coordinate the Authority to Operate (ATO) renewal process, including planning, preparing required materials, managing timelines, and securing approval for all supported applications.

• Ensure all applications maintain a valid ATO on a three-year cycle and lead efforts to validate and maintain accurate security controls throughout each renewal period.

• Review security risk assessment results, inform management, and recommend corrective actions as needed.

• Review and assess risk and scope for high-level security incidents, and develop new management reports from collected metrics across multiple agencies, including trend analysis.

• Lead mid- to high-level incident responses and serve as the incident response specialist for cyber event detection, correlation, response, and recovery.

• Work with stakeholders to address and track Plans of Action and Milestones (POA&Ms) and other compliance requirements, ensuring timely reporting and closure.

• Provide senior-level support across multiple business areas, with a focus on standardized security plan updates, documentation improvements, and long-term process consistency.

• Analyze existing compliance documentation, identify gaps and risks, and guide corrective actions to meet regulatory and organizational requirements.

• Coordinate collaboration among technical teams, business owners, enterprise security personnel, and project leadership to ensure all evidence and artifacts for SSP and ATO processes are complete and maintained.

• Oversee review, updates, and remediation of security controls, ensuring issues are tracked, communicated, and resolved with stakeholders.

• Lead efforts to identify procedural gaps, risks, or needed updates during renewal cycles, ensuring consistent application of best practices across supported systems.

• Contribute to enterprise security governance by providing guidance, maintaining accurate records, mentoring team members, and driving timely completion of compliance activities.

• Collaborate with vendors, auditors, project managers, and analysts outside the core compliance team.

Required Qualifications

• Bachelor's degree in cyber security, Information Assurance, Business Analytics, or an IT-related field, OR 5 years of experience

• 3+ years of Governance, Risk and Compliance (GRC) experience

• 5 years of experience providing audit evidence to comply with security standards such as NIST, PCI, HIPPA, and FERPA

• 5 years of exposure to complex IT web applications within the past 5 years

• 5 years of experience leading meetings and making oral and written reports

• 5 years of experience working as a liaison between different business and IT areas

• Educational or professional knowledge of NIST Framework and Controls

• Strong written and oral communication skills

• Strong documentation skills

• Ability to collaborate cross-functionally

Preferred Qualifications

• Master's degree in Cybersecurity, Information Assurance, Information Systems / IT Leadership, or an MBA with an IT or Security concentration

• Keylight experience (highly desired, 1-3+ years)

• Knowledge or experience creating supporting documentation for IT system audits (highly desired, 2 years)

• Experience creating Disaster Recovery Plans, Business Continuity Plans, and Incident Response Plans (highly desired, 2 years)

Available Benefits

• Medical Benefits (Platinum level plans available)

• Work from home / Hybrid / Onsite options

• PTO

• Holiday Pay

• VTO

• 401K

• Charitable Match

• Training reimbursement

About KēSTA I.T.

Our name says it all; KēSTA I.T. (Keys-to-I.T.) AND our people are our keys to our success!

KēSTA I.T. is a premier Utah-based technical staffing and consulting services firm. We specialize in temporary and permanent placement of Software, Hardware, Network, Cloud, CRM/ERP, Data, End-User support, Web and Executive / leadership-based positions on a full time and consulting basis.

If you're interested in a role where top performance is rewarded, personal time is valued, and excellence is demanded at every level we want to talk to you today!

Where do you want to go? We've got the keys! ~ KēSTA I.T.