Network Security Analyst

Austin, TX

Network Security Analyst - Solicitation #R

Texas Health and Human Services Commission (HHSC)

4-7 years of experience in the field or in a related area. Familiar with standard concepts, practices, and procedures within a particular field. Relies on limited experience and judgment to plan and accomplish goals. A certain degree of creativity and latitude is required. Works under limited supervision with considerable latitude for the use of initiative and independent judgment. Ability to maintain the security and integrity of critical infrastructure systems by preventing unauthorized access and ensuring compliance with laws and regulations related to national security and foreign ownership restrictions.

A network security analyst ensures that information systems and computer networks are secure. This includes protecting the company against hackers and cyber‑attacks, as well as monitoring network traffic and server logs for activity that seems unusual. Additionally, these analysts are responsible for finding vulnerabilities in the computer networks and creating recommendations for how to minimize these vulnerabilities. The network security analyst investigates security breaches, develops strategies for any security issues that arise, and utilizes the help of firewalls and antivirus software to maintain security.

DISCLAIMER:
Candidates for this position will be subject to a pre‑employment security review to determine employment eligibility.

Title:

Network Security Analyst – System Security & Risk (GRC) Specialist
Contract Type: ITSAC Staff Augmentation
Client:
Texas Health and Human Services Commission (HHSC)
Office:
Office of the Chief Information Security Officer (CISO)

Location:

Austin, Texas (Hybrid / Remote per Agency Policy)
Contract Term:
Initial term with potential renewal based on performance and project needs.

HHSC requires an experienced Network Security Analyst – System Security & Risk Specialist to support enterprise cybersecurity Governance, Risk, and Compliance (GRC) operations. The contractor will support System Security Plan (SSP) development, Security Assessments (SA), and Risk Assessments (RA) across HHSC and DSHS application and infrastructure portfolios. The contractor will work directly with program areas, Information Owners (IO), Information Custodians (IC), technical teams, and the CISO Office to ensure security documentation, assessments, and risk records are completed in accordance with NIST SP 800‑53, NIST Risk Management Framework (RMF), DIR Security Control Standards, and HHSC CISO Office procedures.

RSA Archer GRC serves as the system of record for SSPs, SAs, RAs, risks, POA&Ms, and compliance reporting.

• Develop, update, and maintain System Security Plans for HHSC applications and systems.
• Work with program teams, Information Owners, and Custodians to gather control implementation evidence.
• Ensure System Security Plans align with NIST, DIR, and HHSC CISO Office standards.
• Plan and conduct Security Assessments to validate implementation and effectiveness of security controls.
• Review technical, administrative, and operational evidence.
• Document assessment results and track remediation activities.
• Facilitate Risk Assessment workshops with Information Owners and Custodians.
• Identify threats, vulnerabilities, likelihood, and impact.
• Document risks, mitigation plans, and Risk-Based Decisions in RSA Archer.
• Maintain security artifacts, risks, and remediation plans in RSA Archer GRC.
• Support system authorization (ATO) activities and continuous monitoring.
• Prepare audit and oversight evidence.
• Produce leadership reports and security posture metrics.
• Serve as liaison between program areas, technical teams, and CISO Office leadership.
• Provide guidance and training on System Security Plans, Security Assessments, and Risk Assessment processes.

• Completed and updated System Security Plans (SSPs)
• Documented Security Assessment reports and findings
• Completed Risk Assessments and Risk-Based Decisions
• RSA Archer risk and compliance records
• Remediation tracking and status reports
• Audit‑ready security documentation…