IT Security Analyst -Archer GRC
About The Position
The IT Security Analyst will perform cybersecurity, information security governance, and risk management activities, including security risk assessments, compliance reviews, governance, risk, and compliance (GRC) work, security control assessments, and IT audit support. The role includes maintaining risk registers, documenting findings, tracking corrective actions, and developing security documentation, policies, procedures, assessment reports, and executive summaries. The analyst will use Archer or a comparable GRC platform and apply Commonwealth of Virginia information security requirements, including VITA SEC530. The role also covers third-party risk management, business impact analysis, data classification, security feasibility assessments, regulatory compliance, privacy and data-sharing reviews, incident response and continuity governance, and assessment of risks related to emerging technologies. The analyst prepares security metrics, compliance reports, risk summaries, and management briefings, and communicates with technical teams, business owners, auditors, and leadership while managing multiple activities and deadlines.
Requirements
- At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
- At least 3 years of experience performing security risk assessments, compliance reviews, or GRC activities.
- At least 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
- At least 3 years of experience conducting security control assessments and supporting IT audits.
- At least 3 years of experience maintaining risk registers, documenting findings, and tracking corrective actions.
- At least 5 years of experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
- At least 3 years of experience demonstrating strong written and verbal communication with technical teams, business owners, auditors, and leadership.
- At least 3 years of experience managing multiple security assessments, compliance activities, and competing deadlines.
- At least 3 years of experience using Archer or comparable GRC platforms.
- At least 2 years of experience applying Commonwealth of Virginia information security requirements.
- At least 3 years of experience reviewing vendor security documentation, SOC reports, and security questionnaires.
- At least 3 years of experience conducting business impact analyses, data classification reviews, and security feasibility assessments.
- At least 3 years of experience working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
- At least 2 years of experience reviewing data-sharing agreements, MOUs, and security/privacy obligations.
- At least 2 years of experience supporting incident response, disaster recovery, or business continuity compliance.
- At least 1 year of experience assessing security, privacy, and compliance risks associated with emerging technologies.
- At least 3 years of experience preparing security metrics, compliance reports, risk summaries, and management briefings.
Responsibilities
- Perform security risk assessments, compliance reviews, and GRC activities.
- Apply NIST security frameworks, including NIST SP 800-53, and Commonwealth of Virginia information security requirements, including VITA SEC530.
- Conduct security control assessments and support IT audits.
- Maintain risk registers, document findings, and track corrective actions.
- Develop security documentation, policies, procedures, assessment reports, and executive summaries.
- Review vendor security documentation, SOC reports, and security questionnaires.
- Conduct business impact analyses, data classification reviews, and security feasibility assessments.
- Work with applicable regulatory requirements, including CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI.
- Review data-sharing agreements, MOUs, and related security and privacy obligations.
- Support incident response, disaster recovery, or business continuity compliance.
- Assess security, privacy, and compliance risks associated with emerging technologies.
- Prepare security metrics, compliance reports, risk summaries, and management briefings.
- Communicate with technical teams, business owners, auditors, and leadership.
- Manage multiple security assessments and compliance activities alongside competing deadlines.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Education Level
No Education Listed
