Cybersecurity Governance Risk Management Risk Assessment

GRC NIST

Analyst (Jobs Requirement id 159390 Job title Analyst Job location in Richmond, VA Skills required Cyber Security, Information Security, IT Security, Governance Risk Management Risk Assessme Open Date 22-Oct-2026 Close Date Job type Contract Duration 12 Months Compensation DOE Status requirement

• Job interview type

•

Email Recruiter:

coolsoft

Job Description Analyst:

Cyber Security, Information Security, IT Security, Governance Risk Management Risk Assessme Start date: 11/2/2026

End Date :

10/25/2027 Submission deadline: 10/28/2026

Client Info:

DOC Note:

• Remote

In Person Only Description:

This is a remote role. However, DOC has requested that candidates reside in Virginia or within a reasonable distance. They may have them report on site for meetings as needed.

• All interviews are in-person with no exceptions. The statements below describe the principal duties of the position and are not intended to be all-inclusive.
• Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
• Apply and interpret Commonwealth and agency requirements, including

VITA SEC530, NIST

guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.

• Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.
• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
• Coordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit, VITA, and other authorized reviewers.
• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.
• Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
• Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
• Prepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risk or noncompliance through established channels.
• Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordina Call502-379-4456 Ext 100for more details.

Please provide Requirement id:

159390 while calling. EOE Protected Veterans/Disability