Cybersecurity Analyst (GRC)

The NYC Department of Health and Mental Hygiene’s Cyber Command seeks a Cybersecurity Analyst (GRC) to improve Citywide cybersecurity risk, audit, and compliance programs. The role assesses agency cybersecurity risks and compliance, conducts audits and control testing, and supports remediation and adherence to Citywide policies and standards.

Responsibilities

• Review security assessment and service performance reports to identify any significant issues or variances and initiate corrective actions where necessary
• Review and analyze various cybersecurity risk cases, including justification and exceptions documents submitted by agencies
• Assist in the development of cybersecurity risk and compliance assessment procedures and testing methodologies based on established frameworks and guidelines
• Assess NYC Agencies’ documented information security and technology policies, procedures, and practices
• Conduct evaluations of cybersecurity programs or their individual components to ensure compliance with Citywide cybersecurity policies and standards
• Conduct risk-based cybersecurity audits of NYC agencies’ programs, projects, and initiatives, including evaluation of the design and operating effectiveness of security controls
• Execute audit procedures, perform technical and procedural control testing, evaluate supporting evidence, and document results in accordance with established audit methodologies
• Draft and present finding reports accompanied with working papers, concise controls assessments, and systems testing reports (both narrative and table based)
• Prepare and maintain audit working papers that support observations, findings, conclusions, and recommendations; communicate audit results clearly to stakeholders
• Track and validate remediation of audit findings, cybersecurity control deficiencies, and compliance gaps
• Analyze legal, regulatory, contractual, and policy requirements relevant to cybersecurity controls and compliance; support clear documentation of compliance gaps and related recommendations
• Engage in communications with NYC Agencies to assist Agencies in complying with Citywide policies and standards, and
• Handle special projects and initiatives as assigned

Preferred

• Understanding of commonly used computer operating systems, databases, and network structures
• Familiarity with cybersecurity framework(s) (NIST, SANS, PCI, ISO 27001/27002, or CIS)
• Familiarity with internal audit principles, risk-based audit planning, audit evidence, sampling, control design and effectiveness testing, and audit documentation
• Knowledge of applicable professional audit standards and guidance, such as the IIA Global Internal Audit Standards, ISACA IT audit guidance, and government auditing standards (GAGAS), is desirable
• Investigative and analytical skills to analyze logs, security reports, and other data sources to identify trends and anomalies
• A minimum of 1 year of experience in cybersecurity risk assessment or auditing IT systems, or in auditing cybersecurity programs involving direct customer or end-user interaction
• Experience participating in IT or cybersecurity audits, compliance assessments, control testing, or documenting audit findings and recommendations is preferred
• Experience in legal practice, regulatory compliance, investigations, regulatory examinations, or interpreting legal and policy requirements in technology or cybersecurity environments is valued, including experience gained as an attorney or compliance professional
• Experience in information technology, cybersecurity, and customer/end-user facing roles
• One or more of the following certifications are preferred: o CompTIA Security+ o CompTIA Network+ o CompTIA A+ o CompTIA CySA+ o Cisco Certified Network Associate – CCNA o CEH: Certified Ethical Hacker o GIAC Information Security Fundamentals (GISF) o GIAC Security Essentials (GSEC) o (ISC)2 Systems Security Certified Practitioner (SSCP) o Certified Information Systems Auditor (CISA) o Certified Internal Auditor (CIA) o Certified Information Systems Security Professional (CISSP) o Certified in Risk and Information Systems Control (CRISC) o Certified Information Security Manager (CISM)
• Ability to work effectively in a team environment
• Proficient verbal and written communication skills
• Ability to explain technical audit findings, control weaknesses, and remediation recommendations clearly to technical and nontechnical audiences
• Ability to exercise professional skepticism, sound judgment, objectivity, and attention to detail when evaluating evidence and controls
• Being highly organized, motivated, and self-directed
• Knowledge of hardware, software, data, and network principles and systems related to Private and/or Public Sectors services
• Knowledge of risk management concepts, processes, and frameworks
• Ability to manage cybersecurity projects, including planning, implementation, and monitoring
• Ability to analyze complex problems, think critically, and devise effective solutions to assess and mitigate risks
• Ability to research, interpret, and apply applicable laws, regulations, contractual obligations, policies, and standards to cybersecurity governance, risk, compliance, and audit matters
• BS/BA degree in Cybersecurity, Risk Management, or related fields
• A degree in Information Systems, Computer Science, Computer Engineering, Business, Accounting, or a related field is also relevant to cybersecurity audit work
• A Juris Doctor (J.D.), Master of Laws (LL.M.), or other relevant legal education is welcomed, particularly with coursework or experience in cybersecurity law, privacy, regulatory compliance, administrative law, or technology law
• A minimum of 1 year of experience in cybersecurity risk assessment or auditing IT systems, or in auditing cybersecurity programs involving direct customer or end-user interaction.
• Computer Operating Systems
• Databases
• Network Structures
• Cybersecurity Frameworks
• NIST
• SANS
• PCI
• ISO 27001/27002
• CIS
• Internal Audit Principles
• Risk-Based Audit Planning
• Audit Evidence
• Audit Sampling
• Control Design
• Control Effectiveness Testing
• Audit Documentation
• IIA Global Internal Audit Standards
• ISACA IT Audit Guidance
• GAGAS
• Log Analysis
• Security Report Analysis
• Trend
• Anomaly Detection
• Cybersecurity Risk Assessment
• IT Systems Auditing
• Cybersecurity Program Auditing
• IT Audits
• Cybersecurity Audits
• Compliance Assessments
• Control Testing
• Audit Findings Documentation
• Audit Recommendations
• Legal Practice
• Regulatory Compliance
• Regulatory Examinations
• Legal
• Policy Interpretation
• Cybersecurity
• Customer-Facing Experience
• CompTIA Security+
• CompTIA Network+
• CompTIA A+
• CompTIA CySA+
• Cisco CCNA
• Certified Ethical Hacker
• GIAC GISF
• GIAC GSEC
• (ISC)² SSCP
• CISA
• CIA
• CISSP
• CRISC
• CISM
• Technical Audit Findings
• Control Weaknesses
• Remediation Recommendations
• Hardware Principles
• Software Principles
• Data Principles
• Network Principles
• Public Sector Services
• Private Sector Services
• Risk Management
• Risk Management Frameworks
• Cybersecurity Project Management
• Project Planning
• Project Implementation
• Project Monitoring
• Risk Assessment
• Risk Mitigation
• Legal Research
• Regulatory Interpretation
• Contractual Requirements
• Cybersecurity Governance
• Cybersecurity Risk
• Cybersecurity Compliance
• Cybersecurity Audit
• Cybersecurity Degree
• Risk Management Degree

Benefits

• As a prospective employee of the City of New York, you may be eligible for federal loan forgiveness programs and state repayment assistance programs.

Company

• New York City public health agency
• Queens, New York, USA
• https://www.nyc.gov/site/doh/index.page
• Founded in 1866
• 5001-10000 employees

Qualifications

• A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position; or
• Education and/or experience which is equivalent to "1" above
• Understanding of commonly used computer operating systems, databases, and network structures
• Familiarity with cybersecurity framework(s) (NIST, SANS, PCI, ISO 27001/27002, or CIS)
• Familiarity with internal audit principles, risk-based audit planning, audit evidence, sampling, control design and effectiveness testing, and audit documentation
• Knowledge of applicable professional audit standards and guidance, such as the IIA Global Internal Audit Standards, ISACA IT audit guidance, and government auditing standards (GAGAS), is desirable
• Investigative and analytical skills to analyze logs, security reports, and other data sources to identify trends and anomalies
• A minimum of 1 year of experience in cybersecurity risk assessment or auditing IT systems, or in auditing cybersecurity programs involving direct customer or end-user interaction
• Experience participating in IT or cybersecurity audits, compliance assessments, control testing, or documenting audit findings and recommendations is preferred
• Experience in legal practice, regulatory compliance, investigations, regulatory examinations, or interpreting legal and policy requirements in technology or cybersecurity environments is valued, including experience gained as an attorney or compliance professional
• Experience in information technology, cybersecurity, and customer/end-user facing roles
• One or more of the following certifications are preferred: o CompTIA Security+ o CompTIA Network+ o CompTIA A+ o CompTIA CySA+ o Cisco Certified Network Associate – CCNA o CEH: Certified Ethical Hacker o GIAC Information Security Fundamentals (GISF) o GIAC Security Essentials (GSEC) o (ISC)2 Systems Security Certified Practitioner (SSCP) o Certified Information Systems Auditor (CISA) o Certified Internal Auditor (CIA) o Certified Information Systems Security Professional (CISSP) o Certified in Risk and Information Systems Control (CRISC) o Certified Information Security Manager (CISM)
• Ability to work effectively in a team environment
• Proficient verbal and written communication skills
• Ability to explain technical audit findings, control weaknesses, and remediation recommendations clearly to technical and nontechnical audiences
• Ability to exercise professional skepticism, sound judgment, objectivity, and attention to detail when evaluating evidence and controls
• Being highly organized, motivated, and self-directed
• Knowledge of hardware, software, data, and network principles and systems related to Private and/or Public Sectors services
• Knowledge of risk management concepts, processes, and frameworks
• Ability to manage cybersecurity projects, including planning, implementation, and monitoring
• Ability to analyze complex problems, think critically, and devise effective solutions to assess and mitigate risks
• Ability to research, interpret, and apply applicable laws, regulations, contractual obligations, policies, and standards to cybersecurity governance, risk, compliance, and audit matters
• BS/BA degree in Cybersecurity, Risk Management, or related fields
• A degree in Information Systems, Computer Science, Computer Engineering, Business, Accounting, or a related field is also relevant to cybersecurity audit work
• A Juris Doctor (J.D.), Master of Laws (LL.M.), or other relevant legal education is welcomed, particularly with coursework or experience in cybersecurity law, privacy, regulatory compliance, administrative law, or technology law
• A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position; or,

Required skills

• Audit Evidence and Documentation, CCNA, CISM, CISSP, CRISC, Certified Ethical Hacker (CEH), Certified Information Systems Auditor (CISA), Certified Internal Auditor (CIA), CompTIA A+, CompTIA CySA+, CompTIA Network+, CompTIA Security+, Control Testing, Cybersecurity Auditing, Cybersecurity Compliance, Cybersecurity Frameworks CIS, Cybersecurity Frameworks ISO 27001/27002, Cybersecurity Frameworks NIST, Cybersecurity Frameworks PCI, Cybersecurity Frameworks SANS, Cybersecurity Risk Assessment, Databases, GIAC Information Security Fundamentals (GISF), GIAC Security Essentials (GSEC), IT Audit Standards GAGAS, IT Audit Standards IIA, IT Audit Standards ISACA, Network Structures, Operating Systems, Risk Management, Risk-Based Audit Planning, Systems Security Certified Practitioner (SSCP)

Preferred skills

• Ability to work effectively in a team environment, Being highly organized, motivated, and self-directed, Proficient verbal and written communication skills

Experience

• 4+ years