IT Security Governance Analyst

The Custom Group of Companies•Richmond, VA

1d•Remote

About The Position

Seeking an experienced IT Security Governance Analyst to support a large-scale government cybersecurity program. The role focuses on strengthening enterprise security governance, managing cybersecurity risks, ensuring regulatory compliance, and collaborating with technical teams, auditors, and leadership. The position is remote, but candidates must reside in Virginia or within reasonable commuting distance for occasional onsite meetings. Candidates must physically reside in the United States throughout the assignment, and interviews are in person.

Requirements

At least 5 years of experience in cybersecurity, information security, IT governance, or risk management.
At least 4 years of experience applying NIST security frameworks, particularly NIST SP 800-53.
At least 3 years conducting cybersecurity risk assessments, compliance reviews, and GRC activities.
At least 3 years supporting security control assessments and IT audits.
At least 3 years managing risk registers, security findings, remediation plans, and corrective actions.
Strong understanding of cybersecurity governance, risk management, security controls, and regulatory compliance.
Experience developing security policies, procedures, risk assessments, and executive-level reporting.
Excellent communication, analytical, organizational, and stakeholder management skills.
Must reside in Virginia or within reasonable commuting distance for occasional onsite meetings.
Must physically reside in the United States throughout the assignment.
Must be available for an in-person interview.

Nice To Haves

Experience with Archer GRC or comparable governance, risk, and compliance platforms.
Knowledge of VITA SEC530 and Commonwealth of Virginia security requirements.
Experience with CJIS, VCIN, HIPAA, PCI DSS, FERPA, FTI, or related compliance standards.
Background in third-party risk management, SOC report reviews, and vendor security assessments.
Experience conducting Business Impact Analyses, data classification, and privacy reviews.
Familiarity with AI governance, incident response, disaster recovery, and business continuity.
One or more preferred certifications: CRISC, CISA, CGRC, CISSP, or CISM.

Responsibilities

Conduct cybersecurity risk assessments, Business Impact Analyses (BIAs), security control assessments, and compliance reviews.
Maintain risk registers, security findings, remediation plans, and compliance documentation using Archer GRC or similar platforms.
Apply security frameworks and standards, including NIST SP 800-53, VITA SEC530, CIS Controls, and applicable regulatory requirements.
Coordinate internal and external security audits, collect supporting evidence, and track remediation activities through resolution.
Evaluate third-party and vendor security risks, including SOC reports, security questionnaires, and data-sharing agreements.
Develop and maintain security policies, procedures, assessment reports, and governance documentation.
Support privacy, incident response, disaster recovery, and business continuity governance.
Assess security and compliance risks associated with emerging technologies, including AI.
Prepare executive-level security reports, risk assessments, compliance metrics, and remediation updates.
Collaborate with IT teams, business stakeholders, auditors, and leadership to strengthen security controls and regulatory compliance.