IT Security Analyst 2

Ampcus Inc.•Richmond, VA

2d•Remote

About The Position

The IT Security Governance Analyst supports the enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities. This is a remote position; candidates should reside in Virginia or within a reasonable distance to report onsite for meetings as needed. Interviews are in person, with no exceptions. The role conducts security assessments, supports compliance and audit activities, reviews vendor and data-sharing documentation, maintains risk and remediation records, develops governance materials, and provides security guidance to stakeholders. It also supports security awareness, governance reviews for emerging technologies and artificial intelligence, continuity and incident-related governance, and executive and Commonwealth reporting.

Requirements

Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
Knowledge of security frameworks and standards, including NIST SP 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
Ability to analyze technical and business information, identify risks, distinguish control gaps from acceptable residual risks, and recommend clear, defensible actions.
Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on activities involving multiple stakeholders.
Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.
At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
At least 3 years of experience performing security risk assessments, compliance reviews, or GRC activities.
At least 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
At least 3 years of experience conducting security control assessments and supporting IT audits.
At least 3 years of experience maintaining risk registers, documenting findings, and tracking corrective actions.
At least 5 years of experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
At least 3 years of experience demonstrating strong written and verbal communication with technical teams, business owners, auditors, and leadership.
At least 3 years of ability or experience managing multiple security assessments, compliance activities, and competing deadlines.

Nice To Haves

3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
2+ years of experience applying Commonwealth of Virginia information security requirements, including VITA SEC530.
3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
2+ years reviewing data-sharing agreements, MOUs, and security and privacy obligations.
2+ years supporting incident response, disaster recovery, or business continuity compliance.
1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

Responsibilities

Conduct and coordinate security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, control assessments, and security feasibility reviews for systems, applications, services, integrations, and technology initiatives.
Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved tools.
Track remediation commitments, due dates, residual risk, and required executive decisions.
Apply and interpret applicable security requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.
Partner with system and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain authorization, audit, and compliance evidence.
Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and interconnection documentation; identify gaps, conditions, compensating controls, and escalation requirements.
Review interconnection and data-sharing agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
Coordinate audits, assessments, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit teams and authorized reviewers.
Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes; recommend improvements to strengthen compliance and reduce risk.
Support security awareness and training programs, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
Conduct governance reviews for emerging technology and artificial intelligence initiatives, evaluating business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
Prepare executive, management, and Commonwealth reports covering governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
Provide security guidance to project teams, operational IT, procurement, business units, and vendors; facilitate meetings, communicate requirements, and escalate unresolved risks or noncompliance through established channels.
Participate in incident and post-incident governance activities, including documentation reviews, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
Perform other related duties and special projects in support of the IT Security Governance program.