IT & Security Governance Analyst

Communication Service for the Deaf (CSD) is seeking an IT & Security Governance Analyst to support technology governance, security, and operational maturity across corporate IT, cloud, product, and operational systems. The role maintains governance processes, security controls, data stewardship practices, risk tracking, access management, vulnerability management, incident response documentation, and vendor assurance activities.

What you'll do:

• Support the development and maintenance of the organization's IT and security roadmap aligned with mission priorities and partner obligations
• Maintain the technology risk register, including security, data, vendor, and operational risks, and track remediation activities
• Assist with developing, documenting, and maintaining IT and security policies, standards, and procedures
• Maintain system ownership documentation, governance records, and technology inventories
• Prepare technology governance metrics, risk reports, and audit readiness documentation
• Support implementation and maintenance of data classification, access governance, and retention standards
• Document and maintain key data flows across internal systems, partner integrations, and cloud environments
• Review encryption, logging, and access controls for alignment with data sensitivity and contractual requirements
• Partner with Engineering and program teams to support secure and scalable system practices
• Maintain architecture documentation, data flow diagrams, and security control mappings
• Support identity and access management processes, including SSO, MFA, least privilege, access reviews, and joiner-mover-leaver workflows
• Coordinate endpoint and device management practices, including MDM, encryption, patching, configuration baselines, and endpoint protection

What they're looking for:

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or a minimum of one (1) year of relevant experience in IT governance, cybersecurity, IT operations, or risk management
• Experience working across multiple IT or security domains
• Understanding of IAM principles, including SSO, MFA, least privilege, and access reviews
• Working knowledge of areas such as logging, endpoint security, encryption, backup management, vulnerability management, and network security
• Experience supporting IT, data, or security governance initiatives
• Ability to analyze technical risks and develop practical recommendations
• Ability to coordinate cross-functional initiatives and work effectively with technical and non-technical stakeholders
• Experience supporting audits or security frameworks such as PCI DSS, SOC 2, ISO 27001, NIST 800-53 Rev. 5, or HIPAA-adjacent controls
• Experience with AWS, Azure, or GCP and CI/CD environments
• Experience with MDM, EDR, SIEM, vulnerability scanners, or related tooling
• Familiarity with secure software development practices and threat modeling
• Relevant certifications such as Security+, SSCP, GSEC, or equivalent