Office of the
Illinois Attorney General
Kwame Raoul

SUMMARY OF DUTIES AND RESPONSIBILITIES:

Under the direction of the Chief Information Security Officer (CISO), the Senior Cybersecurity Risk and Compliance Analyst will be responsible for ensuring the organization's adherence to cybersecurity standards, assessing risks, and implementing appropriate controls. The Senior Cybersecurity Risk and Compliance Analyst will be responsible for leading and managing cybersecurity compliance initiatives, developing and maintaining cybersecurity policies and procedures, conducting audits and assessments, coordinating compliance across the organization, performing comprehensive risk assessments, collaborating with stakeholders to develop a risk management framework, managing third-party risk, preparing and delivering compliance reports, maintaining accurate documentation, supporting security awareness initiatives, conducting training sessions, and providing guidance on secure data handling and compliance-related matters

MINIMUM QUALIFICATIONS:

 This position requires a bachelor's degree in Computer Science, Information Systems, Cybersecurity or a related field and a minimum of 5 years work experience in cybersecurity compliance, risk assessment, and third-party risk management. Relevant certifications such as CISA, CISSP, CISM, or CRISC are highly desirable. Strong knowledge and experience with SOC2 reviews, NIST CSF, NIST 800-53, and other relevant frameworks are preferred. Familiarity with industry-specific compliance standards such as HIPAA, CJIS and IRS 1075 is a plus. Experience in conducting 3rd-party risk reviews, IT controls assessments, cybersecurity policy compliance reviews, vulnerability assessments and end-user training are expected. Significant knowledge of security technologies, best practices, and emerging trends, as well as strong analytical and problem-solving skills, are essential.

Ability to effectively coordinate, prioritize, and collaborate along with outstanding communication skills to present complex information in a clear and concise manner is required. Attendance and the ability to maintain satisfactory working relationships with OAG employees and the general public is also required.