Cybersecurity GRC Analyst || Richmond, VA || Remote || Contract
About The Position
The Cybersecurity GRC Analyst 2 supports the enterprise cybersecurity program by managing Governance, Risk, and Compliance (GRC), security risk assessments, privacy reviews, control assessments, audit readiness, and remediation tracking. The role maintains risk registers, security documentation, and compliance evidence using Archer GRC and other approved tools. The analyst interprets and implements applicable security frameworks and regulatory requirements, including VITA SEC530, NIST SP 800-53, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI DSS, FERPA, and FTI. The role covers third-party risk assessments, Business Impact Analyses (BIAs), data classification, security and privacy reviews of data-sharing agreements, and support for incident response and business continuity governance. The position also involves reviewing emerging technologies and AI initiatives, developing security policies and procedures, coordinating audits, tracking corrective actions, preparing executive compliance reports, and collaborating with technical teams, business owners, vendors, auditors, and leadership to strengthen security and regulatory compliance. This is a long-term contract role based in Richmond, Virginia, with remote work indicated and in-person interviews only.
Requirements
- At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
- At least 4 years applying NIST security frameworks, including NIST SP 800-53.
- At least 3 years in GRC activities, security risk assessments, control assessments, IT audits, and remediation tracking.
- At least 5 years developing security documentation, policies, procedures, assessment reports, and executive summaries.
- Experience with Archer GRC or similar platforms.
- Experience with third-party risk management and regulatory compliance.
- Strong communication and stakeholder management skills.
Responsibilities
- Manage Governance, Risk, and Compliance (GRC), security risk assessments, privacy reviews, control assessments, audit readiness, and remediation tracking.
- Maintain risk registers, security documentation, and compliance evidence using Archer GRC and other approved tools.
- Interpret and implement applicable security frameworks and regulatory requirements.
- Conduct third-party risk assessments and Business Impact Analyses (BIAs).
- Perform data classification and security and privacy reviews of data-sharing agreements.
- Support incident response and business continuity governance.
- Review emerging technologies and AI initiatives.
- Develop security policies and procedures.
- Coordinate audits and track corrective actions.
- Prepare executive compliance reports.
- Collaborate with technical teams, business owners, vendors, auditors, and leadership to strengthen security and regulatory compliance.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Career Level
Mid Level
Education Level
No Education Listed
