IT Security Analyst

IT Security Analyst
Richmond,VA
Remote


Key Responsibilities

• Conduct and coordinate security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, and technology initiatives.

• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in enterprise GRC platforms (e.g., Archer GRC). Track remediation commitments, due dates, residual risk, and required executive decisions.

• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration hardening, access reviews, and vendor management.

• Apply and interpret industry security frameworks and standards, including NIST guidelines, CIS Controls, and applicable regulatory and contractual obligations (such as HIPAA, PCI, FERPA, and privacy mandates).

• Partner with system and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence required for authorization, audit, and ongoing compliance.

Vendor & Third-Party Risk Management

• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, and other interconnection documentation to identify conditions, gaps, and compensating controls.

• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, and incident-notification requirements.

Audit Coordination & Policy Management

• Coordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal and external reviewers.

• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes, recommending practical improvements that strengthen compliance and reduce risk.

• Support the organizational security awareness and training program, including targeted compliance training, acknowledgements, tracking, and education for stakeholders.

Emerging Technology & Executive Reporting

• Perform governance reviews for emerging technology and artificial intelligence initiatives, evaluating business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, and risks.

• Prepare accurate executive and management reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.

• Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors, facilitating meetings and escalating unresolved risks through established channels.

• Strong knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.

• Comprehensive understanding of security frameworks and standards (e.g., NIST 800-53, CIS Controls, HIPAA, PCI, FERPA).

• Strong ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.

• Exceptional ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.

• Excellent communication and interpersonal skills, with the ability to manage complex assignments under deadlines and handle sensitive information with sound judgment, discretion, and a service-oriented approach.

• GRC Platforms: 3+ years of experience using Archer or comparable GRC platforms.

• Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.

• Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.

• Regulatory Compliance: 3+ years working with regulatory compliance frameworks (HIPAA, PCI DSS, FERPA, etc.).

• Privacy & Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.

• Incident Response & Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.

• Emerging Tech Governance: 1+ year assessing security, privacy, and compliance risks associated with AI and emerging technologies.

• Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.