Special Requirements: Onsite All 5 Days
Location: Columbus, Ohio Locals only

The Ohio Department of Medicaid (ODM) is seeking an IT Security Analyst 3 to support the agency''s enterprise cybersecurity, governance, risk management, compliance, and security operations program. The consultant will provide technical expertise in evaluating security risks, supporting regulatory compliance, conducting security assessments, coordinating audit activities, and assisting with the implementation and maintenance of security controls across ODM applications, infrastructure, cloud services, and third-party environments.
 
The consultant will work closely with the IT Risk & Security Manager, Agency Information Security Officer (AISO), Privacy Officer, Infrastructure Services, application teams, project managers, business stakeholders, and external vendors to support ODM''s cybersecurity strategy and ensure compliance with applicable federal, state, and agency security requirements. The consultant will also support continuous monitoring, governance, risk management, vendor security reviews, audit readiness, vulnerability management, and enterprise security initiatives while helping maintain the confidentiality, integrity, and availability of ODM information systems and data.
 
Responsibilities
•    Acts as lead Salesforce CRM developer and works very closely with Business Analysts, Architects & Project managers in planning the releases.
•    Work with business teams to understand their processes and translate their needs into actionable salesforce requirements for configuration/development.
•    Involved in all aspects of the Project life cycle, from the initial kickoff through the requirements analysis, design, implementation, testing and post-production solution and user support.
•    Maintains and provides enhancements to the existing Salesforce solutions using latest features.
•    Familiar with Salesforce.com best practices related to release management and deploying changes through the various sandboxes to production.
•    All aspects of user and license management including new user setup/deactivation, roles, profiles, permissions, public groups, OWD, sharing rules
•    Data management to improve Salesforce data quality, implementing rules and automation as needed.
•    Provide ad hoc data extracts as per business area needs.
•    Proactive system maintenance including Security Reviews, Release Updates, Health Check, and Optimizer
•    Identify unused or underutilized platform features.
•    Develops and creates dashboards and complex customized reports as per business need.
•    Manages user testing to include developing test plans, creating user test cases.
•    Create and maintain documentation on processes, policies, configuration, and user guides.
•    Leads the Integrations and supports MuleSoft architect in converting existing custom API’s to MuleSoft Anypoint platform.
•    Create a roadmap and define priorities, liaising with stakeholders.
•    Mentors and trains State Development resources.

· Support ODM cybersecurity, governance, risk management, compliance, and security operations initiatives across agency applications, infrastructure, cloud services, and third-party environments.
· Perform security risk assessments, security reviews, and technical evaluations of new and existing systems, applications, and technology initiatives.
· Conduct vendor security reviews and evaluate SOC reports, security questionnaires, architecture diagrams, and compliance documentation.
· Support compliance activities related to CMS, HIPAA, NIST, ARC-AMP-E/MARS-E, IRS Publication 1075, and other applicable federal and state security requirements.
· Participate in audit preparation, evidence collection, audit response activities, remediation tracking, and corrective action planning.
· Identify cybersecurity risks and collaborate with business units, ITS teams, vendors, and project teams to develop mitigation strategies.
· Support Governance, Risk, and Compliance (GRC) activities, including policies, standards, procedures, and documentation.
· Participate in security monitoring, incident response coordination, vulnerability management, and security operations supporting ODM enterprise systems.
· Review system architecture, cloud solutions, infrastructure changes, and third-party integrations to ensure compliance with ODM security requirements.
· Coordinate with the Agency CISO, Risk Manager, Privacy Officer, Infrastructure teams, project managers, business units, and vendors.
· Track security findings, vulnerabilities, POA&Ms, and remediation activities.
· Assist with implementation and maintenance of NIST-aligned security controls and ODM security standards.
· Support continuous monitoring, vulnerability remediation, and operational security improvements.
· Develop executive security reports, compliance documentation, risk summaries, and security metrics.
· Participate in SDLC activities to ensure security requirements are incorporated throughout project implementation.
· Provide security consultation for cloud services, enterprise applications, third-party integrations, and emerging technologies.
· Develop and maintain security documentation, procedures, standards, and compliance artifacts.
· Communicate technical security risks and recommendations to technical and non-technical stakeholders.
· Perform additional cybersecurity, governance, risk management, compliance, and security operations duties as assigned.
ESSENTIAL REQUIREMENTS:
The selected consultant must possess the technical knowledge, professional experience, and communication skills necessary to support the Ohio Department of Medicaid''s cybersecurity, governance, risk management, compliance, and security operations initiatives. The consultant must be capable of working independently while collaborating effectively with technical teams, business stakeholders, executive leadership, vendors, and external partners in a fast-paced government environment.
· Bachelor''s degree in Cybersecurity, Information Security, Computer Science, Information Systems, or related field preferred.
· Minimum 5 years of professional experience in cybersecurity, information security, governance, risk management, or compliance.
· Minimum 3 years conducting security risk assessments, vendor security reviews, or compliance evaluations.
· Experience supporting NIST, CMS, HIPAA, ARC-AMP-E/MARS-E, IRS Publication 1075, or comparable frameworks.
· Experience supporting Governance, Risk, and Compliance (GRC) programs.
· Experience with vulnerability management, audit readiness, evidence collection, remediation tracking, and continuous monitoring.
· Experience reviewing cloud technologies, enterprise architecture, and third-party integrations.
· Strong analytical, documentation, communication, and organizational skills.
DESIRED Skill Sets:
· CISSP, CISM, CISA, Security , CGRC, or equivalent certification preferred.
· Experience with Azure, AWS, or Google Cloud security.
· Experience with SIEM technologies and security monitoring.
· Experience performing vendor security assessments and third-party risk management.
· Knowledge of Medicaid systems or state government security practices preferred.
· Experience supporting Agile project environments.
· Excellent written and verbal communication skills.
· Strong leadership, analytical thinking, and problem-solving abilities.

• Bachelor''s degree in Cybersecurity, Information Security, Computer Science, Information Systems, or related field preferred.
experience in cybersecurity, information security, governance, risk management, or compliance.
conducting security risk assessments, vendor security reviews, or compliance evaluations.
supporting NIST, CMS, HIPAA, ARC-AMP-E/MARS-E, IRS Publication 1075, or comparable frameworks.
Governance, Risk, and Compliance (GRC) programs.
Experience with vulnerability management, audit readiness, evidence collection, remediation tracking, and continuous monitoring.
• Experience reviewing cloud technologies, enterprise architecture, and third-party integrations.
• CISSP, CISM, CISA, Security , CGRC, or equivalent certification preferred.
Experience with Azure, AWS, or Google Cloud security.
• Experience with SIEM technologies and security monitoring.
• Knowledge of Medicaid systems or state government security practices preferred