DOC - IT Security Analyst 2 (814128)

Wiserhunt•Richmond, VA

2d•Remote

About The Position

The IT Security Governance Analyst supports the Virginia Department of Corrections’ enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities. This is a remote role, but candidates should reside in Virginia or within a reasonable distance and may be asked to report onsite for meetings. Interviews are in person only. The analyst conducts and coordinates risk assessments, Business Impact Analyses, data classification and privacy reviews, control assessments, and security feasibility reviews for systems, applications, services, integrations, and technology initiatives. The role maintains assessment records, risk registers, corrective-action plans, exceptions, and evidence in Archer GRC and other approved tools; tracks remediation and residual risk; and supports authorization, audits, and ongoing compliance. The position applies Commonwealth and agency requirements and relevant frameworks and regulations, reviews vendor and third-party security materials and data-sharing agreements, and coordinates audits and oversight activities through corrective-action closure. The analyst also develops security governance documentation, supports security awareness and training, reviews emerging technology and AI initiatives, assists with continuity and control planning, prepares management and executive reporting, advises stakeholders, and participates in incident and post-incident governance activities as assigned. Other related duties and special projects may be assigned.

Requirements

At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
At least 5 years performing security risk assessments, compliance reviews, or GRC activities.
At least 3 years applying NIST security frameworks, including NIST SP 800-53.
At least 4 years conducting security control assessments and supporting IT audits.
At least 3 years maintaining risk registers, documenting findings, and tracking corrective actions.
At least 3 years developing security documentation, policies, procedures, assessment reports, and executive summaries.
At least 3 years of strong written and verbal communication with technical teams, business owners, auditors, and leadership.
At least 3 years managing multiple security assessments, compliance activities, and competing deadlines.
Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
Knowledge of relevant frameworks and standards, including NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
Ability to manage complex assignments, prioritize work under deadlines, and follow through with multiple stakeholders.
Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.
Candidates should reside in Virginia or within a reasonable distance; the role may require onsite attendance for meetings.
Must agree to an in-person interview; interviews are in person only.

Nice To Haves

3 or more years using Archer or comparable governance, risk, and compliance platforms.
2 or more years applying Commonwealth of Virginia information security requirements, including VITA SEC530.
3 or more years reviewing vendor security documentation, SOC reports, and security questionnaires.
3 or more years conducting Business Impact Analyses, data classification reviews, and security feasibility assessments.
3 or more years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
2 or more years reviewing data-sharing agreements, MOUs, and security and privacy obligations.
2 or more years supporting incident response, disaster recovery, or business continuity compliance.
1 or more year assessing security, privacy, and compliance risks associated with emerging technologies.
3 or more years preparing security metrics, compliance reports, risk summaries, and management briefings.

Responsibilities

Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews.
Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools.
Track remediation commitments, due dates, residual risk, and decisions requiring executive input.
Apply and interpret Commonwealth and agency security, privacy, regulatory, and contractual requirements.
Partner with system and data owners to establish ownership, classify information, document security plans and controls, conduct periodic reviews, and maintain authorization and audit evidence.
Review vendor and third-party security documentation, including SOC reports, questionnaires, architecture and data-flow information, contracts, and interconnection documents; identify gaps, controls, and escalation needs.
Review MOUs and related data-sharing agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
Coordinate audits, assessments, and oversight; collect and validate evidence, respond to inquiries, document findings, and manage corrective actions through closure.
Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes; recommend practical improvements.
Support security awareness and training, including targeted training, acknowledgements, tracking, reporting, and stakeholder education.
Conduct governance reviews of emerging technology and AI initiatives, evaluating purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and approvals.
Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
Prepare executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and priorities.
Provide security guidance to project teams, operational IT, procurement, business units, and vendors; facilitate meetings and escalate unresolved risk or noncompliance.
Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
Perform other related duties and special projects supporting the IT Security Governance program.