IT Cybersecurity & Compliance Administrator
20 hours ago
Jacksonville
Job Description:\n\nWho We Are Norlee Group, Inc. is a multi-trade building systems organization delivering integrated electrical, mechanical, and technology solutions across commercial, industrial, institutional, and specialty markets. As part of our continued growth under the One Norlee platform, we are strengthening our cybersecurity, information security, and compliance capabilities to protect our people, systems, data, and business operations.Position Summary The IT Cybersecurity & Compliance Administrator is responsible for supporting and administering Norlee Group's cybersecurity, information security, and compliance program while providing technical support for core IT security operations. This position serves as a key operational owner for Tier 1 cybersecurity and compliance activities, including security control administration, compliance evidence collection, access reviews, vulnerability tracking, security monitoring, policy enforcement, audit preparation, risk management, and security awareness. The role works closely with IT, Infrastructure Engineering, Service Desk, Human Resources, Finance, business leadership, vendors, and external auditors to ensure security controls are consistently implemented, documented, monitored, and maintained. The successful candidate will be highly detail-oriented and comfortable working within structured compliance programs where documentation, evidence, deadlines, and control execution are critical. This position is expected to identify gaps, escalate risks, maintain accurate records, and ensure cybersecurity and compliance requirements are incorporated into day-to-day IT operations.Essential Duties and ResponsibilitiesCybersecurity & Security OperationsAdminister and continuously improve foundational cybersecurity controls, including endpoint protection, email security, MFA, identity and access management, privileged access, network security, system hardening, encryption, and cloud security configurations.Monitor security alerts, notifications, and dashboards and perform initial investigation, triage, documentation, and escalation of suspected security incidents.Support incident response activities by collecting relevant information, documenting events and actions taken, maintaining incident records, and escalating incidents according to established procedures.Maintain and monitor security configurations across endpoints, servers, Microsoft 365, Azure/AWS environments, network infrastructure, and other critical technology platforms.Assist with vulnerability management activities, including vulnerability scanning, remediation tracking, risk prioritization, exception documentation, and verification of corrective actions.Support patch management and security remediation efforts by identifying overdue or non-compliant systems and coordinating remediation with appropriate IT personnel.Assist with secure configuration and hardening standards for Windows, Linux, endpoints, network devices, cloud resources, and business applications.Support identity and access management processes, including account provisioning, deprovisioning, access changes, privileged access reviews, and periodic user access certifications.Investigate and document security-related service desk tickets and escalate issues requiring advanced technical or incident-response support.Support backup, disaster recovery, business continuity, and incident response testing from a cybersecurity and control-validation perspective.Compliance & GovernanceServe as a primary operational resource for maintaining Tier 1 cybersecurity and compliance controls and ensuring required activities are completed on schedule.Support compliance programs and control frameworks such as SOC 2 Type 2, ISO 27001, CMMC, NIST, and other applicable security standards.Maintain compliance control documentation, including control descriptions, procedures, ownership assignments, testing requirements, evidence requirements, and remediation plans.Collect, organize, validate, and maintain audit evidence in accordance with established compliance schedules and requirements.Maintain evidence repositories and ensure artifacts are complete, current, appropriately dated, and traceable to the applicable security control.Perform recurring compliance activities such as access reviews, security awareness tracking, vulnerability reviews, policy acknowledgments, endpoint compliance checks, backup verification, and security configuration reviews.Maintain compliance calendars and control schedules to ensure recurring activities are completed within required timeframes.Track control deficiencies, audit findings, exceptions, corrective actions, and remediation activities through completion.Assist with internal control testing and coordinate with control owners to identify gaps and implement corrective actions.Support preparation for internal and external audits by organizing evidence, responding to auditor requests, coordinating meetings, and tracking outstanding items.Maintain documentation demonstrating the operating effectiveness of cybersecurity and compliance controls.Identify control gaps and potential areas of non-compliance and escalate material risks to appropriate leadership.Assist in maintaining the organization's information security risk register and tracking identified risks through mitigation, acceptance, transfer, or remediation.Support development and maintenance of policies, standards, procedures, and guidelines required by the organization's security and compliance program.Risk Management & Third-Party SecuritySupport third-party/vendor security assessments by reviewing security questionnaires, SOC reports, certifications, policies, and other security documentation.Maintain vendor security records and track outstanding security requirements, exceptions, and remediation activities.Assist in evaluating technology and service providers against organizational security and compliance requirements.Support periodic reviews of critical vendors and service providers based on established risk criteria.Escalate material vendor security concerns and assist in documenting risk acceptance or remediation decisions.Security Awareness & TrainingAdminister the organization's security awareness and training program, including onboarding training, recurring security training, policy acknowledgments, and phishing simulations.Track employee participation and completion and report outstanding requirements to appropriate management.Assist in developing security awareness communications covering phishing, password security, MFA, social engineering, acceptable use, data protection, and other relevant security topics.Promote a security-conscious culture by communicating cybersecurity requirements in a clear and practical manner.IT Administration & Security SupportProvide Tier 1/Tier 2 technical support for security-related systems and controls, including endpoint security, identity platforms, MFA, email security, access controls, and security monitoring tools.Assist with user onboarding and offboarding processes to ensure accounts, devices, applications, permissions, and access rights are provisioned and removed according to established security procedures.Collaborate with Infrastructure Engineering and Service Desk teams to implement and maintain secure technology configurations.Assist with administration of Microsoft 365, Active Directory/Entra ID, endpoint management, security platforms, and other enterprise IT systems.Maintain accurate IT and security documentation, including system inventories, control documentation, procedures, security configurations, and operational runbooks.Contribute to the organization's asset inventory and assist with identifying systems, applications, endpoints, and other technology assets that fall within compliance scope.Participate in technology projects to ensure cybersecurity and compliance requirements are addressed during planning, implementation, and deployment.Perform other duties as assigned.Key Responsibilities / Success Measures Success in this position will be demonstrated through:Consistent completion of assigned cybersecurity and compliance controls.Accurate, complete, and audit-ready compliance evidence.Timely identification and escalation of security risks and control deficiencies.Effective tracking and closure of vulnerabilities, audit findings, and remediation activities.Accurate and timely completion of user access reviews and security-related administrative processes.Maintenance of current security policies, procedures, standards, and supporting documentation.Strong audit readiness with minimal outstanding evidence requests or overdue compliance activities.Effective collaboration between IT, business stakeholders, vendors, and auditors.Continuous improvement of the organization's cybersecurity and compliance posture.Competencies Tech Savvy: Maintains working knowledge of cybersecurity technologies, enterprise IT systems, identity management, endpoint security, cloud platforms, vulnerability management, and security monitoring. Demonstrates an ability to learn and administer new security tools and technologies. Attention to Detail: Demonstrates a high level of accuracy when managing compliance evidence, security records, access reviews, audit documentation, policies, and control activities. Recognizes discrepancies and follows through to resolution. Ensures Accountability: Takes ownership of assigned security and compliance controls, recurring activities, remediation tasks, and audit requests. Consistently meets deadlines and maintains accurate documentation. Manages Complexity: Evaluates security alerts, compliance requirements, vulnerabilities, control deficiencies, and technical issues. Understands how individual security activities contribute to broader organizational risk. Risk Awareness: Recognizes cybersecurity risks and control weaknesses and appropriately escalates issues based on potential business impact. Collaborates: Works effectively with IT, Infrastructure Engineering, Service Desk, Human Resources, Finance, business leaders, vendors, and auditors to implement security controls and meet compliance requirements. Communicates Effectively: Clearly communicates cybersecurity requirements, compliance obligations, risks, deficiencies, and remediation activities to both technical and non-technical audiences.Qualifications To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below represent the knowledge, skills, and abilities required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.Education and/or Experience Associate's or Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field, or equivalent professional experience. A minimum of three (3) years of progressive IT, cybersecurity, information security, or compliance experience is preferred, with demonstrated experience supporting cybersecurity controls and compliance programs. Candidates should have hands-on experience with several of the following:Cybersecurity and information security controlsSOC 2, ISO 27001, CMMC, NIST, or similar compliance frameworksCompliance evidence collection and audit preparationSecurity policies, procedures, standards, and control documentationIdentity and access managementMicrosoft 365 and Entra ID/Active DirectoryEndpoint detection and response (EDR) or endpoint protection platformsSecurity information and event management (SIEM) platformsVulnerability management and remediation trackingMFA and conditional accessSecurity awareness and phishing simulation platformsMicrosoft Azure or AWS security controlsWindows and Linux security administrationNetwork security concepts, including firewalls, VPNs, segmentation, and secure configurationsIncident identification, triage, documentation, and escalationRisk assessments and remediation trackingVendor/third-party security assessments Experience working in an organization subject to formal customer, regulatory, contractual, or third-party cybersecurity requirements is highly desirable. Experience supporting construction, engineering, manufacturing, field services, or other distributed/operational environments is preferred. Professional certifications such as CompTIA Security+, CySA+, SSCP, CISA, CISM, CISSP, ISO 27001, CMMC, or relevant cloud/security certifications are beneficial.Language/Interpersonal/Leadership Skills The successful candidate must possess strong written and verbal communication skills and be able to clearly communicate cybersecurity, compliance, and technical requirements to both technical and non-technical audiences. Strong organizational and documentation skills are essential. The candidate must be comfortable managing multiple recurring compliance activities, deadlines, evidence requests, remediation items, and security-related tasks simultaneously. The individual must demonstrate strong attention to detail and the ability to identify inconsistencies, missing documentation, control gaps, and potential security risks. The candidate should be comfortable working with auditors, vendors, IT personnel, and business stakeholders and must be able to appropriately escalate issues when established security or compliance requirements are not being met. A continuous learning mindset is essential to remain current with evolving cybersecurity threats, technologies, compliance requirements, and industry best practices.Mathematical Skills Basic mathematical skills, including the ability to perform addition, subtraction, multiplication, and division with whole numbers, fractions, and decimals, are necessary for the role.Computer Skills Strong proficiency with enterprise IT and cybersecurity systems is required. Experience should include Microsoft 365, Windows, Active Directory/Entra ID, endpoint security platforms, MFA and identity management solutions, vulnerability management tools, security awareness platforms, SIEM or security monitoring tools, and cloud administration/security environments such as Azure or AWS. Experience with GRC, compliance management, ticketing, documentation, or audit evidence management platforms is highly desirable.Physical Demands The physical demands described here are representative of those required to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. The employee is frequently required to sit, stand, walk, and operate computer equipment. Occasional lifting of up to 15 pounds may be required. Specific vision abilities include close vision, distance vision, peripheral vision, and depth perception.Work Environment This position is primarily office-based and performed within a standard business office environment. Occasional travel within