IT Security Analyst

Role overview

Location and interview

• The posting lists Richmond, Virginia, as the role location.
• Interviews are in person only; this does not establish the work arrangement.

Security governance and risk

• Conduct security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and feasibility reviews.
• Maintain risk and assessment records, corrective-action plans, exceptions, evidence, and follow-up in Archer GRC and approved tools.
• Partner with system and data owners on ownership, classification, security plans, control reviews, and authorization evidence.
• Review vendor security documentation, contracts, architecture, data flows, and interconnection materials; identify gaps and escalation needs.
• Review data-sharing agreements for security, privacy, access, data-handling, notification, and annual-review requirements.

Audit, policy, and program support

• Coordinate audits and oversight, validate evidence, document findings, and track corrective actions through closure.
• Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes.
• Support security awareness and compliance training, including acknowledgements, tracking, reporting, and stakeholder education.
• Review emerging technology and AI initiatives for purpose, sensitivity, privacy, security, oversight, assurances, risks, and approvals.
• Assist with continuity, incident response, disaster recovery, logging, hardening, access reviews, and vendor-management planning.
• Prepare executive and management reporting; advise project teams, IT, procurement, business units, and vendors; support incident governance and special projects.

Knowledge and abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related requirements.
• Analyze technical and business information, identify risk and control gaps, assess residual risk, and recommend defensible actions.
• Develop professional assessment reports, risk registers, security plans, policies, procedures, briefings, and audit evidence.
• Manage complex assignments and deadlines, communicate with varied stakeholders, and handle sensitive information with discretion.

Desired experience

• Archer GRC experience of 3 or more years is listed as a desired, non-mandatory qualification.