IT Security Analyst

Role overview

Assessments and risk management

• Conduct security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved tools.
• Track remediation commitments, due dates, residual risk, and required executive decisions.
• Partner with system and data owners to establish ownership, classify information, document security plans and controls, and maintain authorization and audit evidence.

Reviews, audits, and governance

• Review vendor security documentation, questionnaires, architecture and data-flow information, contracts, and interconnection agreements; identify gaps, controls, and escalation needs.
• Review data-sharing agreements for security, privacy, least privilege, data handling, access control, incident notification, and annual review requirements.
• Coordinate audits and oversight, validate evidence, respond to inquiries, document findings, and manage corrective actions through closure.
• Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes.

Program support and reporting

• Support security awareness and training, including targeted training, acknowledgements, tracking, reporting, and stakeholder education.
• Review emerging technology and AI initiatives for purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and approvals.
• Assist with continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, and vendor management.
• Prepare executive and management reports on workload, inventory, risks, findings, remediation, compliance, metrics, and priorities.
• Provide security guidance to project teams, IT, procurement, business units, and vendors; facilitate meetings and escalate unresolved risks.
• Participate in incident and post-incident governance, including documentation review, control-gap identification, regulatory coordination, and corrective-action tracking.

Knowledge and abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of NIST 800-53, SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related requirements.
• Ability to analyze technical and business information, identify risks, evaluate control gaps and residual risk, and recommend defensible actions.
• Ability to produce assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage complex assignments and deadlines and communicate effectively with executives, technical teams, vendors, auditors, and business partners.
• Ability to handle sensitive information with judgment and discretion.

Experience and skills

• Three or more years of Archer GRC or comparable governance, risk, and compliance platform experience is described as a qualification that would strengthen an application, not a mandatory requirement.