Required Skills:

• Experience in cybersecurity, information security, IT security governance, or risk management (5 Years)
• Experience performing security risk assessments, compliance reviews, or GRC activities (3 Years)
• Experience applying NIST security frameworks, including

NIST SP 800-53

(4 Years)

• Experience conducting security control assessments and supporting IT audits (3 Years)
• Experience maintaining risk registers, documenting findings, and tracking corrective actions (3 Years)
• Experience developing security documentation, policies, procedures, assessment reports, and executive summaries (5 Years)
• Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership (3 Years)
• Ability to manage multiple security assessments, compliance activities, and competing deadlines (3 Years)

Preferred Skills:

• Archer GRC:

  3+ years of experience using Archer or comparable governance, risk, and compliance platforms

• VITA SEC530

  2+ years of experience applying Commonwealth of Virginia information security requirements

• Third-Party Risk Management:

  3+ years reviewing vendor security documentation, SOC reports, and security questionnaires

• Business Impact Analysis:

  3+ years conducting BIAs, data classification reviews, and security feasibility assessments

•

Regulatory Compliance:

3+ years working with

CJIS, VCIN, HIPAA, PCI

DSS, FERPA, or FTI requirements

• Privacy and Data Sharing:

  2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations

• Incident Response and Continuity Governance:

  2+ years supporting incident response, disaster recovery, or business continuity compliance

• AI and Emerging Technology Governance:

  1+ year assessing security, privacy, and compliance risks associated with emerging technologies

•

Executive Reporting:

3+ years preparing security metrics, compliance reports, risk summaries, and management briefingsAbout the role: The IT Security Governance Analyst supports the client enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities.

Responsibilities:

• Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
• Apply and interpret Commonwealth and agency requirements, including

VITA SEC530, NIST

guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.

• Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.
• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
• Coordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit, VITA, and other authorized reviewers.
• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.
• Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
• Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
• Prepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risk or noncompliance through established channels.
• Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects in support of the IT Security Governance program.
• This is a remote role. However, client has requested that candidates reside in Virginia or within a reasonable distance in the event they need to report on site. They may have them report on site for meetings as needed
• Only those lawfully authorized to work in the designated country associated with the position will be considered.
• Please note that all Position start dates and duration are estimates and may be reduced or lengthened based upon a client's business needs and requirements.

•