Job Summary
We are seeking an experienced IT Security Governance Analyst / Cybersecurity GRC Analyst to support the agency’s Information Security Governance, Risk Management, and Compliance program. The ideal candidate will conduct security risk assessments, Business Impact Analyses (BIAs), data classification reviews, privacy assessments, control assessments, and third-party security reviews. This role will ensure compliance with Commonwealth of Virginia security requirements, VITA SEC530, NIST frameworks, CIS Controls, and applicable regulatory standards.
The candidate will work closely with system owners, data owners, IT operations, procurement, vendors, auditors, and executive stakeholders to identify security risks, maintain governance documentation, track remediation activities, and strengthen the agency’s security posture.
Key Responsibilities
- Conduct cybersecurity risk assessments, Business Impact Analyses (BIA), data classification reviews, privacy assessments, control assessments, and security feasibility reviews for systems, applications, integrations, vendors, and technology initiatives.
- Maintain risk registers, assessment documentation, corrective-action plans, security exceptions, audit evidence, and remediation tracking within Archer GRC or comparable Governance, Risk, and Compliance (GRC) platforms.
- Apply and interpret VITA SEC530, NIST SP 800-53, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI DSS, FERPA, FTI, and applicable privacy and contractual requirements.
- Partner with system owners and data owners to document security controls, classify information, maintain security plans, and support system authorization and continuous compliance activities.
- Perform third-party risk management by reviewing SOC 1/SOC 2 reports, vendor security questionnaires, security policies, architecture diagrams, data-flow documentation, contracts, MOUs, MOAs, and NDAs.
- Evaluate security gaps, compensating controls, residual risks, remediation commitments, and escalation requirements for vendor and technology assessments.
- Review interconnection agreements and data-sharing arrangements to ensure appropriate access controls, least privilege, privacy protections, data-handling requirements, incident notification, and periodic reviews.
- Coordinate internal and external audits, security assessments, compliance reviews, evidence collection, audit responses, and corrective-action plans through closure.
- Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes aligned with regulatory and organizational requirements.
- Support security awareness and compliance training programs, including training acknowledgements, participation tracking, compliance reporting, and stakeholder education.
- Evaluate AI and emerging technology initiatives for security, privacy, data sensitivity, vendor assurances, human oversight, regulatory compliance, and required governance approvals.
- Support governance activities related to incident response, disaster recovery, business continuity, access reviews, audit logging, configuration management, system hardening, and vendor management.
- Prepare executive reports, security metrics, risk summaries, compliance dashboards, remediation updates, audit findings, and management briefings.
- Provide security and compliance guidance to technical teams, business units, project managers, procurement teams, vendors, and executive stakeholders.
- Participate in incident and post-incident reviews, document control gaps, coordinate privacy or regulatory follow-up, and track corrective actions.
Required Knowledge and Skills
- Strong knowledge of cybersecurity governance, risk management, compliance, privacy, security controls, and audit processes.
- Familiarity with NIST SP 800-53, VITA SEC530, CIS Controls, DoD STIGs, and Commonwealth of Virginia information security requirements.
- Understanding of regulatory frameworks and requirements, including CJIS, VCIN, HIPAA, PCI DSS, FERPA, and Federal Tax Information (FTI).
- Experience with security risk assessments, Business Impact Analysis, data classification, control assessments, and third-party/vendor risk management.
- Ability to maintain risk registers, security assessment reports, security plans, policies, procedures, audit evidence, and remediation documentation.
- Strong analytical, problem-solving, organizational, and project coordination skills.
- Excellent written and verbal communication skills, including the ability to communicate technical security requirements to nontechnical stakeholders.
- Ability to manage multiple assignments, meet deadlines, handle sensitive information, and coordinate with cross-functional teams.
Preferred Qualifications
- Archer GRC or comparable GRC platform experience.
- Experience applying VITA SEC530 and Commonwealth of Virginia information security policies.
- Experience reviewing SOC reports, vendor security questionnaires, third-party assessments, and security documentation.
- Experience conducting Business Impact Analyses, data classification reviews, privacy assessments, and security feasibility reviews.
- Experience with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI compliance.
- Experience reviewing MOUs, MOAs, data-sharing agreements, and interconnection security documentation.
- Knowledge of incident response governance, disaster recovery, business continuity, and audit remediation.
- Experience assessing AI governance, emerging technology risks, privacy implications, and security compliance.
- Experience preparing executive security reports, compliance metrics, risk summaries, and management presentations.
