Role Description The Cyber Security Governance, Risk, and Compliance (GRC) team is looking for a Principal Security Analyst to be a key member of a critical security program responsible for security risk and compliance activities across the entire enterprise. The role will require working with various company stakeholders to build and mature the processes of preparing for how Blackbaud identifies, documents, and assesses risk across the organization and determine the strength of our control framework and implementation. - Champion the security risk quantification program and process to enable informed decision making across the organization. - Articulate security risk through the development of Key Risk Indicators (KRIs) and report to multiple stakeholder groups, including the Executive Leadership Team (ELT) and Board of Directors. - Develop, assess, and implement cybersecurity controls and procedures required to protect the confidentiality, integrity, and availability of Blackbaud data. - Lead and coordinate internal and external security, compliance, and regulatory assessments, including customer audits, independent attestations, certification audits, and third party reviews. - Serve as the primary liaison with assessors and stakeholders to ensure successful completion of assessment activities and remediation efforts. - Act as a key stakeholder in corporate governance forums and committees by serving as an active advocate for cybersecurity practices, risk management, and policy compliance. - Partner with control owners to continuously monitor control implementations, assess effectiveness, and track noncompliance issues through resolution. - Enhance change management processes to socialize, communicate, and educate stakeholders on policy, standard, and procedure updates. - Identify opportunities to strengthen and mature the organization's governance, risk, and compliance programs through continuous improvement initiatives and industry best practices. Qualifications - 8+ year’s experience in Information Technology and/or Security - 3+ year's experience in leading audit/ assessment projects - 3+ year’s experience in risk management frameworks (i.e., NIST CSF) - 2+ year’s experience in quantitative risk management frameworks (FAIR, OCTAVE, etc.) - Experience in corporate GRC solutions (Archer, ServiceNow, etc.) - Experience in financial services, or other highly regulated industries (i.e. SOX, SOC, PCI DSS) - Experience working in an agile team - Demonstrated understanding of cyber risks and implementing mitigation plans - Possesses effective communication and presentation skills - Ability to handle multiple priorities and high stress situation - Industry Certifications like: CISSP, CRISC, CISM/CISA, AWS certification(s), Azure certification(s) Benefits - Medical, dental, and vision insurance - Remote-flexible workforce - Wellness Programs - 401(k) program with employer match - Flexible paid time off - Generous Parental Leave - Donations for Doers - Pet insurance, legal and identity protection - Tuition reimbursement program

• Continuously monitor security alerts and notifications from various tools and platforms to identify potential threats and vulnerabilities. • Assist in investigating and responding to security incidents, including performing initial triage and documenting findings. • Manage annual incident response testing. • Conduct basic threat analysis and research to understand emerging threats and vulnerabilities relevant to our environment. • Support the configuration and maintenance of security tools and systems to ensure they are properly tuned and up to date. • Help identify, assess, and prioritize vulnerabilities in systems and applications, and assist with remediation efforts. • Maintain and update security documentation, including policies, procedures, and incident reports. • Assist in developing and delivering cybersecurity awareness training to staff members. • Support compliance efforts related to cybersecurity frameworks and standards (e.g., PCI, NIST). • Maintaining a disaster recovery strategy and procedures backup plan. • Monitor and manage the organization’s firewall infrastructure to safeguard network traffic. • Oversee IDS/IPS systems to detect and respond to malicious activities and policy violations. • Maintain and update antivirus solutions and endpoint protection tools to prevent and respond to malware threats. • Utilize SIEM tools to collect, analyze, and correlate security event data from various sources. • Support the management and security of VPNs used for remote access. • Monitor and manage email security systems to prevent phishing and other email-based threats. • Assist in ensuring the integrity and security of data backup and recovery systems. • Audit IAM systems to control and monitor user access and authentication.

• Develop and implement advanced security monitoring and detection. • Provide incident response support and lead investigations. • Collaborate with teams for Threat Detection and Response initiatives.

Role Description At GDIT, people are our differentiators. We are seeking an Associate Cyber Security Analyst to join our team to support Centers for Medicare & Medicaid Services (CMS) activities at Windsor Mill, MD. As a security analyst supporting the Healthcare Integrated General Ledger Accounting System (HIGLAS) contract, you will work with a team of analysts and engineers to scrutinize network and system events for potential indicators of threats or compromise. This effort includes implementing and maintaining security safeguards designed to minimize the CMS security risk and protect confidentiality, integrity, and availability of sensitive data, including privacy information. This is a junior position on the Identity and Access Management (IAM) team and part of a larger security team responsible for establishing and maintaining a high security posture for a critical federal information system. Our team’s security responsibility includes, but is not limited to: - Developing IT security strategy and architecture - Establishing security operations and monitoring - Implementing risk and vulnerability management processes - Remediating weaknesses - Conducting audits and assessments - Maintaining all manner of IT security documentation - Managing access - Enforcing Federal and organizational policies This position allows the opportunity to work 100% remote from home preferably in Eastern or Central time zones. Those local to the Baltimore MD area will have the opportunity to come into our office as needed. HOW YOU WILL MAKE AN IMPACT: - Provide support to and participate in IAM continuous monitoring activities including monitoring new and removed identities, access and permissions changes, privilege escalation, bot activity, and other related activities. - Perform internal audits and assessments related to user access controls, segregation of duties, and compliance with policies and federal standards. - Support analysis of IAM-related anomalies, permission changes, and access patterns as part of broader security monitoring activities. - Draft documentation to detail potential risks associated with known security issues within the environment. - Develop and maintain Standard Operating Procedures (SOPs) related to security tasking. - Coordinate and collaborate with technical subject matter experts (SMEs) to ensure technical and operational security controls are operating as expected. Qualifications - Bachelor’s degree in Information Security, Information Technology, or equivalent years of related information security experience. - General knowledge of identity and access management, role- and attribute-based access controls (RBAC/ABAC), segregation of duties, least privilege, privilege escalation, etc. - Knowledge of general computing technologies (e.g., Windows Server, Linux, databases, scripting languages, etc.). - General experience with analysis of security or information technology issues. Requirements - Ability to pass CMS background check and meet the residency requirement for having resided in the US at least (3) three out of the last (5) five years. - 0+ years of related experience. Benefits - Full-flex work week to own your priorities at work and at home, with core work hours Monday – Friday 9:00 AM ET – 3:00 PM ET. - 401K with company match. - Comprehensive health and wellness packages. - Internal mobility team dedicated to helping you own your career. - Professional growth opportunities including paid education and certifications. - Cutting-edge technology you can learn from. - Rest and recharge with paid vacation and holidays. - Challenging work that makes a real impact on the world around you. - Remote work.