Information Security Analyst Sr

Travis County Technology and Operations is seeking a Senior Information Security Analyst to support the County’s information assurance and cybersecurity programs through advanced compliance, risk management, and audit activities, with substantial responsibility for CJIS compliance.

Location and Work Arrangement

• Austin, TX (hybrid)
• Teleworking: eligible for teleworking, in office as needed
• Office location: 700 Lavaca St, Austin, TX 78701

Compensation

• Salary: USD 86,403 - 120,000 per year

Role Summary

This senior-level classification performs complex information security, compliance, audit, and risk management work within the Information Technology job family. The role uses considerable independent judgment to plan and conduct security assessments and audits, interpret security and compliance requirements, evaluate administrative and technical controls, identify deficiencies and risks, and develop corrective action recommendations.

The position serves as a subject matter resource for the County’s Criminal Justice Information Services (CJIS) compliance program and coordinates compliance and audit activities across departments that access, process, store, transmit, or support Criminal Justice Information (CJI). Responsibilities may include assessing compliance with the FBI CJIS Security Policy, preparing departments for internal and external audits, documenting findings, monitoring remediation, and assisting departments with implementation of required security controls.

Key Responsibilities

• Plan, conduct, document, and report information security compliance assessments, technical and administrative audits, and risk assessments across County departments, systems, applications, processes, and third-party services.
• Administer the County’s CJIS compliance program and assess compliance against applicable FBI CJIS Security Policy requirements.
• Conduct CJIS compliance assessments and internal audits for multiple departments and systems handling CJI.
• Develop and maintain audit methodologies, assessment procedures, evidence requirements, control checklists, questionnaires, workpapers, compliance documentation, and related tools.
• Coordinate audit preparation and evidence collection with departments, Information Technology personnel, departmental security representatives, management, vendors, and other stakeholders.
• Review policies, procedures, system configurations, access controls, security documentation, audit logs, network and system architecture, data flows, training records, personnel security documentation, incident response processes, physical safeguards, and related evidence to determine compliance.
• Document audit and assessment findings, identify control deficiencies and risks, develop corrective action recommendations, and communicate results to technical personnel, departmental management, and executive leadership.
• Develop, track, and monitor corrective action plans, POA&Ms, risk treatment activities, exceptions, and remediation efforts from security assessments and audits.
• Perform follow-up assessments to confirm corrective actions were implemented and deficiencies were addressed.
• Assist departments with interpreting CJIS Security Policy requirements and translating them into practical administrative, technical, and operational controls.
• Support external CJIS audit preparation, including coordinating evidence collection, reviewing documentation, facilitating interviews, responding to audit requests, documenting findings, and monitoring corrective actions.
• Conduct IT and cybersecurity risk assessments using qualitative and quantitative methodologies and evaluate risks related to systems, applications, technology services, vendors, business processes, and security control deficiencies.
• Evaluate administrative, technical, and physical controls against applicable laws, regulations, contractual requirements, County policies, and recognized cybersecurity frameworks and standards.
• Review proposed and existing technologies to identify security, privacy, regulatory, and compliance risks and recommend safeguards and risk treatment measures.
• Develop and maintain security policies, standards, procedures, guidelines, assessment methodologies, and documentation aligned to changes in technology, threats, regulatory requirements, and industry standards.
• Analyze changes to the FBI CJIS Security Policy and other cybersecurity requirements and assess impacts to County systems, departments, policies, procedures, and security controls.
• Prepare technical reports, risk assessments, audit reports, compliance reports, dashboards, presentations, executive summaries, and related documentation.
• Collaborate with information security, IT, privacy, legal, risk management, departmental personnel, and external organizations on cybersecurity risk and compliance matters.
• Provide consultation, guidance, training, and awareness to departments regarding security requirements, CJIS compliance responsibilities, controls, and audit readiness.
• Participate in security governance, risk management, compliance, incident response, business continuity, and other Information Assurance initiatives as assigned.
• May lead projects, mentor staff, and provide technical or compliance guidance to junior staff.
• Perform other job-related duties as assigned.

Required Qualifications

• Education: Bachelor’s degree in Computer Science, Information Systems, Business Administration, or a directly related field
• Experience: five (5) years of relevant work experience, including at least three (3) years in information security
• Alternative pathway: any combination of education and experience equivalent to the stated requirements
• Driver’s license: Valid Texas Driver’s License
• Background checks: Criminal, Driving, Education, and Employment Background Checks Required

Preferred Certification

• Industry-recognized certification such as CompTIA Security+, CISA, CRISC, or CGRC (preferred)

Technologies and Frameworks

• FBI Criminal Justice Information Services (CJIS) Security Policy
• NIST SP 800-53
• NIST AI RMF
• NIST CSF 2.0
• HIPAA

Work Schedule and Additional Information

• Typical hours: 8 am - 5 pm, Monday-Friday
• Availability: may work some holidays, some nights, and some weekends
• Work setting: primarily office setting on-site or in a secure hybrid/telework environment
• Travel/visits: occasional visits to data centers, agency offices, or vendor locations for security inspections, audits, or meetings
• Security protocols: must adhere to strict security protocols, including physical access controls, background checks, and secure area clearances
• Incident response: may work outside normal business hours to respond to security incidents or meet project deadlines
• Physical requirements: extended sitting; operation of computer and standard office equipment; occasional lifting/carrying (typically less than 25 pounds)
• Focus: must remain focused and alert while working on detailed technical tasks, especially during incident response or time-sensitive audits
• Business continuity: employees can be assigned to business continuity efforts outside normal job functions

Contact

For updates or questions regarding this position, contact [email protected].