IT Security Governance Analyst (BHJOB1435_35923) Astyra Corporation - 4.2 Richmond, VA Job Details Full-time $45 - $50 an hour 14 hours ago Benefits Health insurance Dental insurance 401(k) Vision insurance Qualifications Contract management Risk management compliance audits

NIST SP 800-53 PCI

Information security audit implementation Security risk assessment investigation IT policy development

CISSP HIPAA

Analysis skills Bachelor's degree Regulatory Frameworks (Architecture security) IT control testing Information security auditing Security Testing Policy Development Audit support Full Job Description IT Security Governance Analyst

•This is an 11-month contract position

•Remote - Local Richmond, VA only, please Description The IT Security Governance Analyst supports the enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities. Responsibilities Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives. Maintain risk registers, assessment records, corrective action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved tools. Track remediation commitments, due dates, residual risks, and required executive decisions. Apply and interpret applicable information security requirements, including NIST guidance, CIS Controls, DoD Security Technical Implementation Guides (STIGs), criminal justice information requirements, and applicable

HIPAA, PCI

DSS, FERPA, federal tax information, privacy, and contractual obligations. Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence required for authorization, audits, and ongoing compliance. Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, memoranda of understanding (MOUs), memoranda of agreement (MOAs), nondisclosure agreements (NDAs), and other interconnection documentation. Identify risk conditions, control gaps, compensating controls, and escalation requirements. Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege access, data handling, access control, incident notification, and annual review requirements. Coordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal auditors and other authorized reviewers. Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk. Support the security awareness and training program, including targeted compliance training, acknowledgments, tracking, reporting, and education for system owners, technical staff, and other stakeholders. Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs. Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas. Prepare accurate executive management and organizational reports covering governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities. Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risks or noncompliance through established channels. Participate in incident response and post-incident governance activities as assigned, including documentation reviews, control gap identification, privacy or regulatory coordination, and corrective action tracking. Perform other related duties and special projects in support of the IT Security Governance program. Skills/Knowledge/Experience Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk management, and audit practices. Knowledge of security frameworks and standards, such as

NIST SP 800-53, CIS

Controls, criminal justice information requirements, and applicable healthcare, payment card, education, federal tax information, and other regulatory requirements. Ability to analyze technical and business information, identify risks, distinguish control gaps from acceptable residual risks, and recommend clear, defensible actions. Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence. Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving multiple stakeholders. Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners. Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Experience and Skills Archer GRC:

3 years of experience using Archer GRC or comparable governance, risk, and compliance platforms.

Information Security Requirements:

2 years of experience applying applicable information security requirements.

Third-Party Risk Management:

3 years of experience reviewing vendor security documentation, SOC reports, and security questionnaires.

Business Impact Analysis:

3 years of experience conducting BIAs, data classification reviews, and security feasibility assessments.

Regulatory Compliance:

3 years of experience working with criminal justice information, healthcare, payment card, education, or federal tax information requirements.

Privacy and Data Sharing:

2 years of experience reviewing data-sharing agreements, MOUs, and security and privacy obligations.

Incident Response and Continuity Governance:

2 years of experience supporting incident response, disaster recovery, or business continuity compliance.

AI and Emerging Technology Governance:

1 year of experience assessing security, privacy, and compliance risks associated with emerging technologies.

Executive Reporting:

3 years of experience preparing security metrics, compliance reports, risk summaries, and management briefings.

Certifications and Relevance CRISC:

Enterprise risk management and control assessment.

CISA:

Information systems auditing and compliance.

CGRC:

Governance, risk, and compliance.

CISSP:

Broad cybersecurity knowledge and risk management.

CISM:

Information security governance and program management. 3. Recommended Screening Priorities Priority Qualification Experience Cybersecurity Governance, Risk, and Compliance (GRC) — 5 years of overall security experience. NIST SP 800-53 and Security Control Assessments — 4 years. Security Auditing and Compliance — 3 years. Risk Registers and Remediation Tracking — 3 years. Archer GRC or Comparable GRC Platforms — 3 years preferred. Applicable Information Security Requirements — 2 years preferred.

Certifications and Relevance CRISC:

Enterprise risk management and control assessment.

CISA:

Information systems auditing and compliance.

CGRC:

Governance, risk, and compliance.

CISSP:

Broad cybersecurity knowledge and risk management.

CISM:

Information security governance and program management. 3. Recommended Screening Priorities Priority Qualification Experience Cybersecurity Governance, Risk, and Compliance (GRC) — 5 years of overall security experience. NIST SP 800-53 and Security Control Assessments — 4 years. Security Auditing and Compliance — 3 years. Risk Registers and Remediation Tracking — 3 years. Archer GRC or Comparable GRC Platforms — 3 years preferred. Applicable Information Security Requirements — 2 years preferred. Required Skills/Knowledge/Experience Experience in cybersecurity, information security, IT security governance, or risk management — 5 years required . Experience performing security risk assessments, compliance reviews, or GRC activities — 3 years required . Experience applying NIST security frameworks, including

NIST SP 800-53

— 4 years required . Experience conducting security control assessments and supporting IT audits — 3 years required . Experience maintaining risk registers, documenting findings, and tracking corrective actions — 3 years required . Experience developing security documentation, policies, procedures, assessment reports, and executive summaries — 3 years required . Strong written and verbal communication skills when working with technical teams, business owners, auditors, and leadership — 3 years required . Ability to manage multiple security assessments, compliance activities, and competing deadlines — 3 years required . Proper email communication will only be done to and from @astyra.com email addresses. Please ensure you are communicating with approved Astyra recruiters by checking this point when receiving offers and messages from us. Please ensure you are communicating within these guidelines and proper channels for the quickest possible interview consideration! #

ASTIT Pay:

$45.00 - $50.00 per hour Expected hours: 40.0 per week

Benefits:

401(k) Dental insurance Health insurance Vision insurance

Education:

Bachelor's (Preferred)

Experience:

Cybersecurity Governance:

5 years (Required)

NIST SP 800-53

4 years (Required)

Security Auditing and Compliance:

3 years (Required)

Risk Registers and Remediation Tracking:

3 years (Required)

Location:

Richmond, VA 23225 (Required)

Work Location:

Remote