This role supports the DOC enterprise cybersecurity governance program, focusing on security risk assessments, compliance, privacy, security controls, third-party risk, audit activities, data-sharing governance, incident response, and security assurance. The candidate will work with system owners, data owners, vendors, technical teams, auditors, and business stakeholders to identify risks, maintain compliance, track remediation, and strengthen the organization's security posture.
Key Requirements:
- Cybersecurity governance, risk management and compliance
- NIST 800-53
- VITA SEC530
- CIS Controls / DoD STIGs
- CJIS / VCIN
- HIPAA / PCI / FERPA / FTI
- Security and privacy risk assessments
- Business Impact Analysis (BIA)
- Data classification and security controls
- Third-party/vendor risk management
- SOC reports and security questionnaires
- Privacy and data-sharing governance
- MOU/MOA reviews
- Audit and compliance activities
- Security policies, procedures and documentation
- Incident response / Disaster Recovery / Business Continuity
- Executive security and compliance reporting
Preferred Experience:
- 3+ years Archer GRC or similar GRC platform
- 2+ years VITA SEC530
- 3+ years Third-Party Risk Management
- 3+ years BIA/Data Classification/Security Assessments
- 2+ years Privacy & Data Sharing
- 2+ years Incident Response/DR/BC Governance
- 3+ years Executive Reporting
- AI/emerging technology governance experience
Please send your updated resume and confirm your current Virginia location, availability for an in-person interview, and experience with NIST 800-53, Archer GRC, VITA SEC530, third-party risk and security assessments.
