Local candidates only. You must already live in Virginia, or close enough to Richmond to come in for meetings and interviews, today. We are not considering relocation, and applications from outside the area will not move forward. This job is remote most of the time, but it is not a work-from-anywhere job. The agency may call you to its Richmond office for meetings as needed, and every interview is in person in Richmond, no exceptions. A Virginia state agency is adding two IT security governance analysts to its enterprise cybersecurity program. These are contract seats through our firm, a Virginia SWaM certified small business, planned from November 2, 2026 through October 25, 2027.

What you would do:

run and coordinate security risk assessments, business impact analyses, data classifications, privacy reviews and control assessments for new and existing systems. Keep the risk registers, assessment records, corrective action plans, exceptions and evidence current in the agency's GRC platform (Archer).

Apply Commonwealth and agency requirements:

VITA SEC530, NIST

guidance, CIS Controls, DoD STIGs, CJIS and VCIN, and HIPAA, PCI, FERPA and FTI where they apply. Review vendor security documentation such as SOC reports, questionnaires, data flows, MOUs and MOAs, and flag gaps and compensating controls. Support audits and VITA oversight by collecting evidence and managing findings to closure. Write and maintain policies, standards, procedures and templates. Support security awareness training. Do governance reviews for new technology and AI initiatives. What the agency needs to see. It scores each line, so please show it plainly on your resume with employers and dates:

• 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
• 3 years of experience in performing security risk assessments, compliance reviews, or GRC activities.
• 4 years of experience in applying NIST security frameworks, including

NIST SP 800-53.

• 3 years of experience in conducting security control assessments and supporting IT audits.
• 3 years of experience in maintaining risk registers, documenting findings, and tracking corrective actions.
• 5 years for the first opening; 3 years for the second opening of experience in developing security documentation, policies, procedures, assessment reports, and executive summaries.
• 3 years of experience in written and verbal communication with technical teams, business owners, auditors, and leadership.
• 3 years of experience in managing multiple security assessments, compliance activities, and competing deadlines. Helpful, not required:
• 3+ years with Archer or a comparable governance, risk and compliance platform.
• 2+ years applying Virginia

VITA SEC530

requirements.

• 3+ years of third-party risk reviews, vendor security documentation, SOC reports and security questionnaires.
• 3+ years of business impact analysis, data-classification reviews and security-feasibility assessments.
• 3+ years with

CJIS, VCIN, HIPAA, PCI

DSS, FERPA or FTI requirements.

• 2+ years reviewing data-sharing agreements, MOUs and security/privacy obligations.
• 2+ years supporting incident-response, disaster-recovery or business-continuity compliance.
• 1+ year assessing emerging-technology security, privacy and compliance risks.
• 3+ years preparing security metrics, compliance reports, risk summaries and management briefings.
• For the second opening only: certifications such as CRISC, CISA, CGRC, CISSP or CISM.

For any helpful qualifications you have, include the employer or project, start and end month/year, and a short example. These are optional qualifications, not additional requirements. The things that are firm on this one. You must already live in Virginia or close enough to Richmond to come in when asked. You must be able to come to the Richmond office for meetings when asked. Interviews are in person. You must live and work in the United States for the whole assignment. The agency closes submissions within days, so it wants the seats filled fast. Pay is $34.50 to $44.50 an hour, and you pick the structure. W2 with full benefits is $34.50 an hour: you are our employee, with medical, dental and vision, paid Virginia state holidays and five days of paid time off. Family coverage is available, and your share of the premium depends on who you cover. W2 with paid holidays only is $39 an hour: you are our employee with paid Virginia state holidays and no medical, dental or vision. Corp to corp is up to $44.50 an hour, through your own established company, one layer, no third party vendors. If this looks like you, apply and answer the screening questions in as much detail as you can. Those answers are how we decide who we call. The people who tell us specifically where and when they did each of these things, even when one line is thinner than the others, are the people who get interviews.

Pay:

$34.50

• $44.

50 per hour Application Question(s): This job is only open to people who already live in Virginia or close enough to Richmond to come in for meetings and interviews. Do you live there today? (yes or no) Will you be able to reliably commute to Richmond, VA 23225 for this job? What city and 5-digit ZIP code do you live in today?

Required:

3 years. How many years have you worked in written and verbal communication with technical teams, business owners, auditors, and leadership? Tell us where (employer or project), the start and end month/year, and one short example of the work. Every interview for this job is in person in Richmond, no exceptions. Will you interview in person? (yes or no) Will you be physically located in the United States for the entire assignment? (yes or no)

Required:

5 years. How many years have you worked in cybersecurity, information security, IT security governance, or risk management? Tell us where (employer or project), the start and end month/year, and one short example of the work.

Required:

3 years. How many years have you worked in performing security risk assessments, compliance reviews, or GRC activities? Tell us where (employer or project), the start and end month/year, and one short example of the work.

Required:

4 years. How many years have you worked in applying NIST security frameworks, including

NIST SP 800-53?

Tell us where (employer or project), the start and end month/year, and one short example of the work.

Required:

3 years. How many years have you worked in conducting security control assessments and supporting IT audits? Tell us where (employer or project), the start and end month/year, and one short example of the work.

Required:

3 years. How many years have you worked in maintaining risk registers, documenting findings, and tracking corrective actions? Tell us where (employer or project), the start and end month/year, and one short example of the work.

Required:

5 years for the first opening; 3 years for the second opening. How many years have you worked in developing security documentation, policies, procedures, assessment reports, and executive summaries? Tell us where (employer or project), the start and end month/year, and one short example of the work. What is your earliest available start date, taking any required notice period into account?

Required:

3 years. How many years have you worked in managing multiple security assessments, compliance activities, and competing deadlines? Tell us where (employer or project), the start and end month/year, and one short example of the work. Pay is $34.50 to $44.50 an hour, and you pick the structure. W2 with full benefits is $34.50 an hour: you are our employee, with medical, dental and vision, paid Virginia state holidays and five days of paid time off. Family coverage is available, and your share of the premium depends on who you cover. W2 with paid holidays only is $39 an hour: you are our employee with paid Virginia state holidays and no medical, dental or vision. Corp to corp is up to $44.50 an hour, through your own established company, one layer, no third party vendors. Which of the three do you want? (pick one)

Work Location:

Hybrid remote in Richmond, VA 23225