IT Security Governance Analyst

Summit Human Capital•Richmond, VA

16h

About The Position

Summit Human Capital is seeking a highly motivated IT Security Governance Analyst to support a public-sector client in Virginia. The position supports enterprise cybersecurity governance, risk, compliance, privacy, and security assurance activities across a broad range of systems and stakeholders. The role requires considerable experience in information security or a closely related discipline, working knowledge of security assessments and control validation, and the ability to interpret requirements and communicate analyses clearly. The hourly pay range is $30–$40, depending on experience, skills, and qualifications.

Requirements

Considerable experience in information security, cybersecurity governance, IT risk management, compliance, audit, privacy, or a closely related IT discipline.
Working knowledge of security assessment methodologies, control validation, risk documentation, and remediation tracking.
Experience interpreting and applying security policies, standards, and regulatory or contractual requirements.
Demonstrated ability to prepare clear written analyses, reports, and stakeholder communications.
Ability to manage multiple complex assignments and prioritize work under deadlines.
Ability to maintain confidentiality and comply with background and access standards.

Nice To Haves

Experience in state government, corrections, criminal justice, public safety, healthcare, or another highly regulated environment.
Experience with Archer GRC or another governance, risk, and compliance platform.
Relevant certifications such as Security Plus, CISM, CRISC, CISSP, CISA, HCISPP, or comparable credentials.

Responsibilities

Conduct and coordinate security risk assessments, Business Impact Analyses, privacy reviews, and control assessments for systems and technology initiatives.
Maintain risk registers, assessment records, corrective-action plans, and evidence repositories in approved agency tools.
Apply and interpret Commonwealth and agency requirements, including NIST, VITA SEC530, CIS Controls, CJIS, HIPAA, PCI, FERPA, and contractual obligations.
Partner with system and data owners to establish ownership, classify information, and maintain security plans and controls.
Review vendor and third-party security documentation, identify gaps, and support interconnection and data-sharing governance.
Develop, maintain, and communicate security policies, standards, procedures, and governance processes.
Support security awareness and training programs for system owners, technical staff, and stakeholders.
Prepare executive, management, and Commonwealth reporting on governance workload, risks, findings, and compliance status.