Risk and Compliance Manager

Agency: Board of Elections 
Closing Date/Time: Thursday, August 6th, 2026 at 11:59 p.m.
Anticipated Starting Salary: $8,334 - $10,834 per month

Full Range:  $8,334 - $12,917 per month

County: Sangamon
Number of Vacancies: 1

FLSA Status: Exempt

The SBE is a non-code agency.

All applicants who want to be considered for this position MUST apply electronically through the illinois.jobs2web.com website. State of Illinois employees should click the link near the top left to apply through the SuccessFactors employee career portal.

Applications submitted via email or any paper manner (mail, fax, hand delivery) will not be considered.

As a State of Illinois employee, you receive a comprehensive benefits package including:
•    Competitive Group Insurance benefits including health, life, dental and vision plans
•    Flexible work schedules (when available and dependent upon position)•    10 -25 days of paid vacation time annually (10 days for first year of state employment)
•    12 days of paid sick time annually which carryover year to year
•    3 paid personal business days per year
•    13 paid holidays per year
•    12 weeks of paid parental leave
•    Pension plan through the State Employees Retirement System
•    Deferred Compensation Program – voluntary supplemental retirement plan
•    Optional pre-tax programs -Medical Care Assistance Plan (MCAP) & Dependent Care Assistant Plan (DCAP)
•    Tuition Reimbursement Program and Federal Public Service Loan Forgiveness Program eligibility

For more information regarding State of Illinois Benefits follow this link: https://www2.illinois.gov/cms/benefits/Pages/default.aspx

Work Hours: 8:00 - 4:30 PM Monday - Friday
Work Location: 2329 S. MacArthur Blvd, Springfield IL 62704
Agency Contact: dmartinez@elections.il.gov
Posting Group: Science, Technology, Engineering and Mathmatics

****A RESUME IS REQUIRED FOR THIS JOB POSTING****

Please attach a DETAILED Resume/Curriculum Vitae (CV), a copy of your transcripts or diploma for all degrees earned, and a copy of any applicable professional licensures to the MY DOCUMENTS section of your application. 

Why Work for Illinois?

Working with the State of Illinois is a testament to the values of compassion, equity, and dedication that define our state. Whether you’re helping to improve schools, protect our natural resources, or support families in need, you’re part of something bigger—something that touches the lives of every person who calls Illinois home.

No matter what state career you’re looking for, we offer jobs that fit your life and your schedule—flexible jobs that provide the gold standard of benefits. Our employees can take advantage of various avenues to advance their careers and realize their dreams. Our top-tier benefits and great retirement packages can help you build a rewarding career and lasting future with the State of Illinois.

Functional Statement

Reporting to the Chief Information Security Officer (CISO), the Risk & Compliance Manager is responsible for: Designing, implementing, and leading a modern enterprise cybersecurity Governance, Risk, Compliance (GRC) program; Ensuring continuous improvements of governance, risk, and compliance capabilities; Ensuring cybersecurity risk is identified, measured, clearly understood, and managed in alignment with adopted frameworks, agency priorities, regulatory requirements, and overall technology strategy; Continuously monitor cybersecurity risk posture, perform gap analysis and provide recommendations for compensating technical, administrative, and physical controls; Tracking the agency's alignment to information security standards; Collaborating with agency stakeholders to develop prescriptive guidance to reduce risk; Reviewing policies, standards, procedures, controls documentation, and audit results; Managing third-party risk by maintaining an inventory of all technology providers and service organizations as well as performing continuous security posture monitoring; Overseeing the agency's security awareness program.

Essential Function 1

Develops and implements risk management plans and processes that are aligned to business objectives and security requirements. Collaborates with agency stakeholders and control owners to develop and implement testing and evidence gathering methodologies. Analyzes and interprets audit results and provides recommendations to system owners and senior leadership to reduce risk. Serves as risk management subject matter expert in support of agency projects. Leverages GRC, vulnerability management, and service desk tools to track progress and distribute compliance and risk remediation task assignments.

Essential Function 2

Conducts third-party service organization risk assessments to ensure supply chain risk is managed throughout the business relationship lifecycle. Establishes and maintains relationships with third-party vendors. Continuously monitors third-party risk by periodically gathering and analyzing vendor documentation such as System and Organization Controls (SOC2 Type II), International Organization for Standardization (ISO 27001), technical diagrams, penetration test results, continuity plans, etc. Reports on the benefits and risks for the agency as well as requirements for service provider compliance. Creates, maintains, and distributes third-party vendor security questionnaires. Serves as the agency's liaison to ensure successful external third-party risk and vulnerability assessments. Communicates assessment results to leadership, business stakeholders, and program managers. Documents Corrective Action Plans (CAP) as needed and assists with the creation of agency Plan of Action & Milestones (POA&M).

Essential Function 3

Assists with the research, creation, maintenance, implementation and communication of Information Security policies, standards, controls, and procedures documentation. Evaluates and documents technical, administrative, and physical controls to ensure the agency demonstrates compliance and meets the requirements of its regulatory obligations. Leads efforts to remediate control gaps and presents findings to leadership. Facilitates data collection and eDiscovery efforts to support investigations of policy violations. Collaborates with the Information Security Operations team and other agency stakeholders to analyze security incidents and provide recommendations to reduce risk. Establishes and maintains a detailed risk register for the organization. Oversee organization-wide Business Impact Analysis (BIA) processes. Collaborate with agency stakeholders to establish and maintain Continuity of Operations Planning (COOP) and Disaster Recovery Planning (DRP).

Essential Function 4

Develops and matures the agency's security awareness program. Utilizes a combination of third-party education resources and services, threat intelligence, and industry trends to create and distribute annual and supplemental security awareness trainings. Periodically provides agency staff with additional education opportunities such as presentations or workshops that are focused on information security, risk, and compliance.

Essential Function 5

Continues education by attending training, seminars, conferences, and obtaining industry certifications. Maintains a current understanding of the threat landscape by monitoring online information security related websites, blogs, articles, reports, as well as other security intelligence sources to remain current on the latest threats, indicators of compromise (IOCs) and trends. Participates in cybersecurity focused organizations.

Essential Function 6

Performs other duties as required or assigned which are reasonably within the scope of the duties enumerated above. Provides off-hours support as required.

Minimum Qualifications 1

Bachelor’s degree in a Cybersecurity or Information Technology field, and a minimum of 10 years in Information Technology roles including 5 years of combined professional experience in information security and risk management. 

Minimum Qualifications 2

Advanced knowledge in information security technologies, design, and architecture in on-premises and cloud hosted environments. 

Minimum Qualifications 3

Experience with the selection, implementation, and management of third-party GRC, exposure management, and awareness platforms such as Bitsight, Knowbe4, ServiceNow, Netwrix, Qualys, and Tenable. 

Minimum Qualifications 4

Solid understanding of cyber risk management, strategy, and security frameworks such as: NIST, CIS, OWASP, COSO, ISO, FAIR, etc. 

Minimum Qualifications 5

Must have excellent analytical and planning skills and be highly organized and detail oriented.

Minimum Qualifications 6

Possesses the ability to write and communicate effectively with both technical and non-technical audiences. 

Minimum Qualifications 7

Comfortability presenting to executive leadership. 

Minimum Qualifications 8

Ability to take unpopular positions when necessary to ensure risk is fully and accurately communicated to agency leadership.

Minimum Qualifications 9

The following professional certifications are required:

• ISACA Certified in Risk and Information Systems Control (CRISC)

• ISC2 Certified Information Systems Security Professional (CISSP)

• ISC2 Certified Cloud Security Professional (CCSP)

Preferred Qualifications 1

The following professional certifications are also desired:

• EC Council Certified Ethical Hacker (CEH)                           
• CompTIA Project+     
• CompTIA Cloud+
• ISC2 Certified in Governance, Risk and Compliance (CGRC) 
•  CompTIA Network+    
• COBIT: Control Objectives for Information and Related Technology  
• ITIL: Information Technology Infrastructure Library

The State Board of Elections welcomes all and promotes workplace diversity. It is our individual traits, character, and experiences that make each of us special and unique. It is only when we bring that individualism together and work as a diverse team that we thrive. There is no place for discrimination based on race, religion, culture, sexual identity or orientation, age, or disability at the State Board of Elections.

APPLICATION INSTRUCTIONS

Use the “Apply” button at the top right or bottom right of this posting to begin the application process.
If you are not already signed in, you will be prompted to do so.
State employees should sign in to the career portal for State of Illinois employees – a link is available at the top left of the Illinois.jobs2web.com homepage in the blue ribbon. 
Non-State employees should log in on the using the “View Profile” link in the top right of the Illinois.jobs2web.com homepage in the blue ribbon.  If you have never before signed in, you will be prompted to create an account.
If you have questions about how to apply, please see the following resources:
State employees: Log in to the career portal for State employees and review the Internal Candidate Application Job Aid
Non-State employees: on Illinois.jobs2web.com – click “Application Procedures” in the footer of every page of the website.