Security Analyst

ASCENDING•Richmond, VA

2d•Hybrid

About The Position

We are seeking an experienced Information Security Analyst to support governance, risk, compliance, privacy, and security initiatives across enterprise programs, systems, applications, and third-party engagements. The role partners with business stakeholders, project teams, legal and privacy teams, and IT to ensure appropriate security controls, documentation, and risk-management practices are in place. The ideal candidate has experience with GRC processes, security frameworks, risk assessments, security documentation, and stakeholder communication.

Requirements

At least 3 years of experience in information security, with emphasis on governance, risk, and compliance (GRC).
Strong understanding of information security principles, practices, controls, and risk-management methodologies.
Experience working with security frameworks such as NIST, ISO 27001, or similar standards.
Familiarity with security and privacy documentation, including SSPs, risk assessments, system diagrams, data flows, and process maps.
Knowledge of IT infrastructure planning, implementation, and management principles.
Experience supporting third-party/vendor risk reviews, contract reviews, or supplier security assessments.
Excellent written, verbal, and stakeholder communication skills.
Strong organizational skills, attention to detail, and ability to manage multiple priorities.
Ability to work independently, meet deadlines, and adapt effectively in changing or ambiguous environments.

Nice To Haves

Experience using a GRC platform.
Experience supporting security and privacy programs in a regulated environment.
Relevant certifications such as Security+, CISSP, CISM, CRISC, ISO 27001, or comparable credentials.
Experience supporting security awareness and training programs.

Responsibilities

Maintain and update security, risk, compliance, and related documentation within a Governance, Risk, and Compliance (GRC) platform.
Partner with business and technology stakeholders to develop and maintain Information System Security Plans (SSPs).
Facilitate information-gathering sessions for SSPs, risk assessments, control evaluations, and other security work products.
Participate in information security and privacy initiatives across business units, systems, projects, and supplier engagements.
Represent Information Security on project and PMO initiatives to ensure security and privacy requirements are addressed throughout the project lifecycle.
Collaborate with business teams to understand operational needs, identify security risks, recommend practical control options, and support compliance requirements.
Assist in developing, maintaining, and improving information security policies, standards, processes, and procedures.
Research industry best practices and applicable security guidance from reputable sources.
Create and maintain controls documentation, including system diagrams, process maps, risk assessment templates, and security artifacts.
Review vendor contracts, agreements, and supporting documentation to help ensure appropriate information security protections are included.
Support security awareness, education, and other enterprise security initiatives as needed.