About the Job

Job Description
The Ohio Department of Medicaid (ODM) is seeking an experienced IT Security Analyst 3 to support enterprise cybersecurity, Governance, Risk & Compliance (GRC), risk management, security assessments, audit readiness, vulnerability management, and security operations.
The consultant will work closely with security leadership, infrastructure and application teams, project managers, business stakeholders, vendors, and external partners to ensure compliance with federal, state, and agency security requirements.
Key Responsibilities
Perform security risk assessments, security reviews, and technical evaluations of applications, systems, and technology initiatives.
Conduct vendor security assessments and review SOC reports, security questionnaires, architecture diagrams, and compliance documentation.
Support compliance with NIST, CMS, HIPAA, ARC-AMP-E/MARS-E, IRS Publication 1075, and comparable security frameworks.
Support audit preparation, evidence collection, audit responses, remediation tracking, and corrective action plans.
Identify cybersecurity risks and develop appropriate risk mitigation strategies.
Support GRC programs, including security policies, standards, procedures, and documentation.
Participate in vulnerability management, continuous monitoring, incident response coordination, and security operations.
Review cloud environments, enterprise architecture, infrastructure changes, and third-party integrations for security compliance.
Track security findings, vulnerabilities, POA&Ms, and remediation activities.
Assist with implementation and maintenance of NIST-aligned security controls.
Prepare security reports, risk summaries, compliance documentation, and security metrics.
Participate in SDLC activities and ensure security requirements are incorporated into projects.
Provide security guidance for cloud services, enterprise applications, third-party integrations, and emerging technologies.
Communicate security risks and recommendations to both technical and non-technical stakeholders.

Required Qualifications
Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Systems, or a related field preferred.
5+ years of professional experience in cybersecurity, information security, GRC, risk management, or compliance.
3+ years of experience conducting security risk assessments, vendor security reviews, or compliance evaluations.
Experience with NIST, CMS, HIPAA, ARC-AMP-E/MARS-E, IRS Publication 1075, or comparable frameworks.
Experience supporting Governance, Risk & Compliance (GRC) programs.
Experience with vulnerability management, audit readiness, evidence collection, remediation tracking, and continuous monitoring.
Experience reviewing cloud technologies, enterprise architecture, and third-party integrations.
Strong analytical, documentation, communication, and organizational skills.

Preferred / Highly Desired Skills
CISSP, CISM, CISA, Security+, CGRC, or equivalent certification.
Experience with Azure, AWS, or Google Cloud security.
Experience with SIEM technologies and security monitoring.
Experience with vendor security assessments and third-party risk management.
Knowledge of Medicaid systems or state government security practices.
Experience working in Agile environments.
Strong leadership, analytical, and problem-solving skills.

Required Skills

• IT Security Analyst 3