IT Security Analyst 2

TOMORROW HIRE•Richmond, VA

1d•Remote

About The Position

The Virginia Department of Corrections is seeking an IT Security Analyst 2 to support its enterprise cybersecurity program, with a focus on security governance, risk management, compliance, privacy, third-party risk, and audit readiness. The analyst evaluates risks across systems, applications, services, vendors, and technology initiatives; maintains governance records; reviews security controls and data-sharing agreements; and supports compliance with Commonwealth of Virginia and applicable federal requirements. The role conducts security assessments, maintains risk and corrective-action documentation, coordinates audits, and works with technical teams, business owners, vendors, and auditors to identify risks and improve security practices. It also supports awareness training, emerging technology reviews, executive reporting, and governance activities related to incident response, disaster recovery, business continuity, audit logging, system hardening, access reviews, and vendor management. The position is remote, with occasional onsite attendance in Virginia for meetings as needed.

Requirements

At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
At least 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
At least 3 years of experience performing security risk assessments, compliance reviews, or governance, risk, and compliance (GRC) activities.
At least 3 years of experience conducting security control assessments and supporting IT audits.
At least 3 years of experience maintaining risk registers, documenting findings, and tracking corrective actions.
At least 3 years of experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
Strong written and verbal communication skills when working with technical teams, business owners, auditors, and leadership.
Ability to manage multiple security assessments, compliance activities, and competing deadlines.
Ability to analyze technical and business information, identify control gaps, evaluate residual risk, and recommend practical corrective actions.
Ability to handle sensitive information with discretion and professional judgment.

Nice To Haves

3+ years of experience using Archer GRC or a comparable governance, risk, and compliance platform.
2+ years of experience applying Commonwealth of Virginia information security requirements, including VITA SEC530.
3+ years of experience reviewing vendor security documentation, SOC reports, and security questionnaires.
3+ years of experience conducting Business Impact Analyses, data classification reviews, and security feasibility assessments.
3+ years of experience working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
2+ years of experience reviewing data-sharing agreements, MOUs, and security and privacy obligations.
2+ years of experience supporting incident response, disaster recovery, or business continuity compliance.
1+ year of experience assessing security, privacy, and compliance risks associated with AI or emerging technologies.
3+ years of experience preparing security metrics, compliance reports, risk summaries, and management briefings.

Responsibilities

Conduct security risk assessments, Business Impact Analyses (BIAs), data classification reviews, privacy reviews, control assessments, and security feasibility reviews.
Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and remediation tracking in Archer GRC or other approved tools.
Apply relevant security frameworks and requirements, including NIST guidance, VITA SEC530, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI, FERPA, and FTI.
Work with system and data owners to document security plans, assign ownership, classify information, review controls, and maintain audit and authorization evidence.
Review third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, and interconnection agreements.
Evaluate data-sharing agreements, MOUs, and related documents for security, privacy, access control, least-privilege, data-handling, and incident-notification requirements.
Coordinate audits and assessments, validate evidence, document findings, respond to inquiries, and track corrective actions through closure.
Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes.
Support security awareness and compliance training, including acknowledgements, tracking, reporting, and stakeholder education.
Review emerging technology and artificial intelligence initiatives for security, privacy, compliance, data sensitivity, vendor assurances, and required approvals.
Support governance activities related to incident response, disaster recovery, business continuity, audit logging, system hardening, access reviews, and vendor management.
Prepare executive and management reports covering security risks, findings, remediation progress, compliance status, metrics, and program priorities.
Provide security guidance to project teams, IT operations, procurement, business units, and vendors; facilitate meetings and escalate unresolved risks when needed.
Support post-incident governance reviews, control-gap identification, regulatory coordination, and corrective-action tracking.
Perform other related duties and special projects as assigned.