IT Security Analyst

Role overview

Governance and risk duties

• Conduct security risk assessments, Business Impact Analyses, data classifications, privacy and control assessments, and feasibility reviews for systems and technology initiatives.
• Maintain risk and assessment records, corrective-action plans, exceptions, and evidence repositories; track remediation commitments, due dates, residual risks, and executive decisions.
• Apply Commonwealth and agency requirements, security standards, and applicable privacy, regulatory, and contractual obligations.
• Work with system and data owners on ownership, data classification, security plans, control documentation, periodic reviews, and authorization or audit evidence.
• Review vendor security documentation, SOC reports, questionnaires, architecture and data flows, contracts, and interconnection agreements; identify gaps, controls, and escalation needs.
• Coordinate audits and oversight, validate evidence, respond to inquiries, document findings, and track corrective actions to closure.
• Develop and maintain policies, standards, procedures, guidelines, templates, and governance processes; recommend improvements.
• Support security awareness and training, including acknowledgements, tracking, reporting, and education.
• Review emerging technology and AI initiatives for business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and approvals.
• Assist with continuity, incident response, disaster recovery, business continuity, audit logging, hardening, access reviews, and vendor management planning.
• Prepare executive, management, and Commonwealth reporting on inventory, risks, findings, remediation, compliance, metrics, and priorities.
• Provide security guidance to project teams, IT, procurement, business units, and vendors; facilitate meetings and escalate unresolved risks.

Knowledge and abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of NIST 800-53, SEC530, CIS Controls, CJIS and VCIN, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risks and control gaps, assess residual risk, and recommend clear actions.
• Ability to prepare assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage complex assignments, prioritize deadlines, and follow through with multiple stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical partners.
• Ability to handle sensitive information with sound judgment and discretion.

Experience and skills

• The desired-qualifications section says these qualifications strengthen an application but are not mandatory.
• The visible experience-and-skills text begins with 3+ years using Archer or comparable governance tooling; the source description cuts off before the qualification is complete.