Security Specialist - Remote

About us

Creative Information Technology Inc (CITI) is an esteemed IT enterprise renowned for its exceptional customer service and innovation. We serve both government and commercial sectors, offering a range of solutions such as Healthcare IT, Human Services, Identity Credentialing, Cloud Computing, and Big Data Analytics. With clients in the US and abroad, we hold key contract vehicles including GSA IT Schedule 70, NIH CIO-SP3, GSA Alliant, and DHS-Eagle II.

Join us in driving growth and seizing new business opportunities.

Role and Responsibilities

The Information Security Risk Analyst is responsible for performing an annual third-party risk assessment (TPA) of a technical implementation vendor. The basis of the assessment is the North Carolina Statewide Information Security Manual. The role will work with a lead analyst to perform the assessment and will own the delivery of System and Data Inventory, a Risk Registry, Risk Assessment Report (RAR).

Required Qualifications

• 5 Years of thorough knowledge of mainstream operating systems and security technologies, including network security appliances, identity and access management, and cryptography.
• 3 Years working knowledge of the IT security industry and federal/state regulations, with deep understanding of NIST SP 800-53, SP 800-30, and SP 800-37
• 3 Years of strong ability to perform vendor interviews, evaluate evidence, and provide feedback to vendors
• 3 Years ability to prioritize and summarize risk assessment status to project managers and executive leadership.
• Bachelor’s degree in Computer Science or a related IT field from an appropriately accredited institution and two years of progressive experience in IT Security or a closely related area; OR Associate degree in Computer Science or a related IT field and three years of progressive experience; OR An equivalent combination of education and experience.
• Professional certifications such as CISSP or CISM.
• Experience performing NIST 800-53 based risk assessments.
• Experience with the NIST Cybersecurity Framework (CSF) and Privacy Framework.

Preferred Qualifications

• Experience completing HITRUST risk assessments.