IT Security Analyst 2

Novalink Solutions LLC•Richmond, VA

22h

About The Position

The IT Security Analyst 2 supports the agency’s IT Security Governance program by conducting security and privacy assessments, maintaining governance records, interpreting applicable security requirements, coordinating audits, and advising stakeholders on risk and compliance. The role works with system and data owners, vendors, technical and business teams, auditors, and agency leadership to support authorization, ongoing compliance, and risk remediation. The analyst reviews systems, applications, services, integrations, technology initiatives, vendor materials, and data-sharing agreements. The position maintains risk registers, assessment documentation, corrective-action plans, exceptions, and evidence in Archer GRC and other approved agency tools. It also develops and communicates governance documentation, supports security awareness and training, evaluates emerging technology and AI initiatives, contributes to continuity and incident-response governance, and prepares executive and Commonwealth reporting. The role requires knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, audit practices, and relevant frameworks and regulatory requirements. The analyst must be able to assess risk, produce clear documentation, manage multiple assignments, communicate with varied audiences, and handle sensitive information with discretion.

Requirements

At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
At least 3 years of experience performing security risk assessments, compliance reviews, or GRC activities.
At least 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
At least 3 years of experience conducting security control assessments and supporting IT audits.
At least 3 years of experience maintaining risk registers, documenting findings, and tracking corrective actions.
At least 3 years of experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
At least 3 years of experience demonstrating strong written and verbal communication with technical teams, business owners, auditors, and leadership.
At least 3 years of experience managing multiple security assessments, compliance activities, and competing deadlines.
Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Nice To Haves

At least 3 years of experience using Archer or comparable governance, risk, and compliance platforms.
At least 2 years of experience applying Commonwealth of Virginia information security requirements, including VITA SEC530.
At least 3 years of experience reviewing vendor security documentation, SOC reports, and security questionnaires.
At least 3 years of experience conducting Business Impact Analyses, data classification reviews, and security feasibility assessments.
At least 3 years of experience working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
At least 2 years of experience reviewing data-sharing agreements, MOUs, and security and privacy obligations.
At least 2 years of experience supporting incident response, disaster recovery, or business continuity compliance.
At least 1 year of experience assessing security, privacy, and compliance risks associated with emerging technologies.
At least 3 years of experience preparing security metrics, compliance reports, risk summaries, and management briefings.

Responsibilities

Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for systems, applications, services, integrations, and technology initiatives.
Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools; track remediation commitments, due dates, residual risk, and executive decisions.
Apply and interpret Commonwealth and agency requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.
Partner with system and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence for authorization, audit, and ongoing compliance.
Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and interconnection documentation; identify gaps, conditions, compensating controls, and escalation needs.
Review MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
Coordinate audit, assessment, and oversight activities; collect and validate evidence, respond to inquiries, document findings, and manage corrective actions through closure with internal audit, VITA, and other authorized reviewers.
Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes; recommend practical improvements to strengthen compliance and reduce risk.
Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for stakeholders.
Conduct governance reviews for emerging technology and artificial intelligence initiatives, evaluating business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
Prepare executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
Provide security guidance to project teams, operational IT, procurement, business units, and vendors; facilitate meetings, communicate requirements, and escalate unresolved risk or noncompliance through established channels.
Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
Perform other related duties and special projects in support of the IT Security Governance program.