Cybersecurity Risk and Compliance Analyst

MasterApp Labs•Richmond, VA

3d•Remote

About The Position

The Cybersecurity Risk and Compliance Analyst performs cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit activities. The role analyzes technical and business information to identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions. It also involves developing and maintaining professional security documentation and communicating findings to executives, technical teams, vendors, auditors, and business partners. The position is remote in Richmond, Virginia, with possible onsite attendance for meetings as needed. Interviews are conducted in person only.

Requirements

At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
At least 3 years of experience performing security risk assessments, compliance reviews, or GRC activities.
At least 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
At least 3 years of experience conducting security control assessments and supporting IT audits.
At least 3 years of experience maintaining risk registers, documenting findings, and tracking corrective actions.
At least 5 years of experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
At least 3 years of strong written and verbal communication with technical teams, business owners, auditors, and leadership.
At least 3 years of ability to manage multiple security assessments, compliance activities, and competing deadlines.
Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
Ability to analyze technical and business information, identify risks, distinguish control gaps from acceptable residual risk, and recommend clear actions.
Ability to manage complex assignments, prioritize work under deadlines, and follow through on actions involving multiple stakeholders.
Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Nice To Haves

3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
2+ years of experience applying Commonwealth of Virginia information security requirements, including VITA SEC530.
3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
3+ years conducting business impact analyses, data classification reviews, and security feasibility assessments.
3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
2+ years reviewing data-sharing agreements, MOUs, and security and privacy obligations.
2+ years supporting incident response, disaster recovery, or business continuity compliance.
1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

Responsibilities

Perform security risk assessments, compliance reviews, and GRC activities.
Conduct security control assessments and support IT audits.
Maintain risk registers, document findings, and track corrective actions.
Develop and maintain security documentation, policies, procedures, assessment reports, and executive summaries.
Manage multiple security assessments and compliance activities while prioritizing deadlines and following through with stakeholders.
Communicate security and compliance matters to executives, technical teams, vendors, auditors, and nontechnical business partners.
Handle sensitive information with sound judgment and discretion.