IT Security GRC Analyst

Position Overview

Key Responsibilities

• Risk & Compliance Assessments: Perform security risk assessments, Business Impact Analyses (BIAs), data classifications, third-party vendor reviews (SOC reports, MOUs), and compliance audits.
• Framework Management: Apply and interpret key security standards and policies (VITA SEC530, NIST, CIS Controls, CJIS, VCIN, HIPAA, PCI, FERPA, FTI).
• GRC Maintenance: Track remediation commitments, maintain risk registers, and manage audit evidence using Archer GRC and other enterprise tools.
• Policy & AI Governance: Develop security policies, templates, and training. Perform governance reviews for emerging technology and AI initiatives.
• Stakeholder Collaboration: Provide security guidance to IT, business units, and vendors, preparing executive briefings and metrics on risk status.

Key Skills Required

• Core Cybersecurity & GRC: 5+ years in IT security governance, cybersecurity, or risk management.
• Security Frameworks: 4+ years of hands-on experience applying NIST SP 800 standards.
• Risk Assessments & Audits: 3+ years conducting security risk/control assessments, supporting audits, and tracking corrective actions.
• Documentation & Reporting: 5+ years writing security policies, assessment reports, and executive summaries.
• Communication: 3+ years managing multiple assessments and effectively communicating across technical teams, leadership, and auditors.

Desired Skills (Bonus)

• 3+ years: Archer GRC platform experience, Third-Party Risk Management, BIAs, Regulatory Compliance (CJIS/HIPAA/PCI).
• 2+ years: VITA SEC530 compliance, Data-Sharing Agreements (MOUs), Incident Response/Continuity Governance.
• 1+ year: AI & Emerging Technology Governance.

Candidate Requirements

• Must physically reside within the United States.
• Willingness to report on-site in Richmond, VA as needed.
• Ability to attend an in-person interview.