IT Security Governance Analyst || Richmond, VA || Remote
About The Position
The IT Security Governance Analyst supports cybersecurity governance, risk management, compliance, and audit activities. The role assesses security risks, reviews compliance with security standards, maintains risk documentation, and coordinates remediation activities across IT teams and business stakeholders. Responsibilities include conducting security risk and control assessments; maintaining risk registers, assessment records, audit evidence, and corrective-action plans; applying security frameworks and regulatory requirements; reviewing vendor security documentation; supporting audits, privacy reviews, data classification, and security policies and procedures; preparing compliance reports and management briefings; coordinating security awareness training; and evaluating risks associated with emerging technologies and AI.
Requirements
- At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
- At least 3 years of experience performing security risk assessments, compliance reviews, or GRC activities.
- At least 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
- At least 3 years of experience conducting security control assessments, supporting IT audits, and tracking remediation activities.
- At least 5 years of experience preparing security documentation, policies, procedures, and assessment reports.
- Strong communication, analytical, documentation, and organizational skills.
Nice To Haves
- Experience with Archer GRC or similar GRC platforms.
- Knowledge of VITA SEC530, CIS Controls, CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI.
- Experience in third-party risk management, business impact analysis, privacy reviews, and AI governance.
Responsibilities
- Conduct security risk assessments, control reviews, and compliance assessments.
- Maintain risk registers, assessment records, audit evidence, and corrective-action plans.
- Apply security frameworks such as NIST SP 800-53 and relevant regulatory requirements.
- Review vendor security questionnaires, SOC reports, and third-party security documentation.
- Support IT audits, privacy reviews, data classification, and security policies and procedures.
- Prepare compliance reports, risk summaries, and management briefings.
- Coordinate security awareness training and evaluate risks associated with emerging technologies and AI.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Career Level
Mid Level
Education Level
No Education Listed
