INTERVIEW= Onsite / Virtual
JOB TYPE= Onsite
1. SCOPE OF WORK
1.1. The Contractor shall provide Information Technology (IT) staff augmentation services in support of the Department's Office of Information Technology (Client), Information Security function. The Contractor must propose at least one qualified Senior Security & Compliance Analyst in its Response who, in the Department's sole discretion, has the experience and ability to fulfill the requirements of this Scope of Work (SOW). The position is anticipated to be Full-Time.
1.2. On an ongoing basis, the Senior Security & Compliance Analyst will report to the Department's Information Security Manager (ISM), the designated Contract Manager (Section 15). The candidate will work closely with the Office of Information Technology, the Office of General Counsel, and Department program areas, and may serve as a liaison with the Florida Digital Service and with solution providers/suppliers on security matters. All work products are subject to ISM review and approval as described in Section 4.6. The candidate must demonstrate the following abilities for consideration:
1.2.1. Broad mastery of information security across governance and operations — able to both author policy and standards and perform the hands-on technical work to implement and validate controls.
1.2.2. Fluency in security control frameworks (NIST SP 800-53, NIST CSF) and the ability to map and crosswalk controls to the Florida Cybersecurity Standards (Rule 60GG-2, F.A.C.).
1.2.3. Risk-based judgment — able to assess control gaps, prioritize remediation, and document risk decisions for management review.
1.2.4. Clear technical writing — able to produce audit-ready policy, procedure, assessment, and management-response documentation.
1.2.5. Operational competence in a Microsoft 365 / Microsoft Defender environment, including endpoint security, vulnerability management, identity and access controls, and incident response support.
1.2.6. Ability to explain security risks, trade-offs, and remediation options to non-security stakeholders, including executives and counsel.
1.3. The Senior Security & Compliance Analyst will provide, but not be limited to, the following activities and tasks.
- Minimum Qualifications. The candidate must possess the minimum qualifications and experience of the STC Job Family cited in Section 2 (Security Management, Job #6810, Security Analyst (C. Advanced)), together with the following Department minimum qualifications and experience:
- Per the STC Job Family description: a minimum of four (4) years of combined IT and security work experience with a broad range of exposure to systems analysis, applications development, and database design and administration, including one to two (1–2) years of experience with information security, and knowledge of security issues, techniques, and implications across all existing computer platforms.
- Minimum of seven (7) years across information security disciplines, with demonstrated experience in both security governance/compliance (GRC) and hands-on security operations.
- Demonstrated experience drafting information security policy and standards and implementing NIST SP 800-53 and/or NIST CSF controls.
- Demonstrated experience performing security risk assessments and supporting internal or external audits.
- On-site availability at the Department's location, 4040 Esplanade Way, Tallahassee, Florida. Remote work may be considered on an occasional, ad-hoc basis with prior written approval of the Contract Manager; this is not a hybrid or permanent remote arrangement. Travel costs will not be reimbursed.
- Education and Certification. The candidate must possess, at a minimum, a Bachelor's degree in computer science, information systems, cybersecurity, or a related field, or equivalent work experience; and at least one current industry certification from the following (others may be considered):
- CISA — Certified Information Systems Auditor (strongly aligned to the GRC/audit core).
- CRISC — Certified in Risk and Information Systems Control.
- CGRC — Certified in Governance, Risk and Compliance (formerly CAP).
- CISM — Certified Information Security Manager.
- CISSP — Certified Information Systems Security Professional.
- Preferred Qualifications. The following are preferred and will strengthen a candidate's evaluation:
- Florida state government or public-sector information security experience.
- Working knowledge of Rule 60GG-2, F.A.C., and Section 282.318, Florida Statutes.
- CJIS Security Policy implementation or audit experience.
- HIPAA Security Rule and PHI-handling experience.
- Hands-on Microsoft 365 G5, Microsoft Defender (Endpoint, Vulnerability Management), and Microsoft Purview experience.
- Vulnerability management tooling and remediation-coordination experience.
- Experience developing IAM / access-control standards and provisioning-integrity controls.
- PowerShell or comparable scripting for security automation and reporting.
