Cybersecurity Risk Analyst

MasterApp Labs•Richmond, VA

7h•Remote

About The Position

The Cybersecurity Risk Analyst performs cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit work. The role analyzes technical and business information to identify risks, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions. It also develops and maintains assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence; coordinates assignments and actions involving multiple stakeholders; and communicates with executives, technical teams, vendors, auditors, and business partners. The position is a contract role based in Richmond, Virginia, with remote work available and on-site attendance for meetings as needed. Interviews are in person only.

Requirements

At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
At least 3 years of experience performing security risk assessments, compliance reviews, or GRC activities.
At least 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
At least 3 years of experience conducting security control assessments and supporting IT audits.
At least 3 years of experience maintaining risk registers, documenting findings, and tracking corrective actions.
At least 3 years of experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership; 3 years of experience indicated.
Ability to manage multiple security assessments, compliance activities, and competing deadlines; 3 years of experience indicated.
Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
Knowledge of security frameworks and standards including NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
Ability to analyze technical and business information, identify risk, assess control gaps and residual risk, and recommend defensible actions.
Ability to manage sensitive information with discretion and a service-oriented approach.

Nice To Haves

3+ years using Archer or comparable governance, risk, and compliance platforms.
2+ years applying Commonwealth of Virginia information security requirements, including VITA SEC530.
3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
3+ years conducting business impact analyses, data classification reviews, and security feasibility assessments.
3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
2+ years reviewing data-sharing agreements, MOUs, and security and privacy obligations.
2+ years supporting incident response, disaster recovery, or business continuity compliance.
1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.
CRISC, CISA, CGRC, CISSP, or CISM certification.

Responsibilities

Analyze technical and business information to identify risks, distinguish control gaps from acceptable residual risk, and recommend actions.
Develop and maintain assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
Conduct security risk assessments, compliance reviews, GRC activities, security control assessments, and support IT audits.
Maintain risk registers, document findings, and track corrective actions.
Manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving multiple stakeholders.
Communicate with executives, technical teams, vendors, auditors, and nontechnical business partners.
Handle sensitive information with sound judgment, discretion, and a service-oriented approach.