Systems Security Analyst #00255

DHRM•Richmond, VA

About The Position

The Library of Virginia seeks a versatile and motivated Systems Security Analyst to support operational, technical, governance, and compliance activities that protect the agency’s information systems, networks, applications, cloud environments, and data assets. This newly created role will review, update, and administer security monitoring and incident-tracking procedures; proactively examine system security logs; and respond effectively to potential issues. The analyst will partner with technical and non-technical staff to advance data security practices at the Library of Virginia, a cultural heritage organization and state agency. The role provides security design guidance for agency projects; supports disaster recovery and business continuity planning and cybersecurity training; creates departmental efficiencies; improves security information gathering and response; coordinates remediation and validates corrective actions; and strengthens governance, risk assessment, and compliance procedures for information system security. The position also serves as backup to the Information Security Officer during absences or delegated assignments.

Requirements

Broad knowledge of cybersecurity principles, frameworks, and best practices, including state and federal standards.
Experience in vulnerability management, incident response, audit coordination, and risk management methodologies.
Experience conducting risk assessments and security control evaluations.
Experience monitoring and assessing security alerts, incidents, vulnerability scans, security logs, and threat intelligence.
Experience developing and maintaining IT security policies, standards, procedures, metrics, and supporting documentation.
Ability to communicate technical concepts orally and conduct security awareness and role-based cybersecurity training for non-technical audiences.
Experience coordinating internal and external audit responses and remediation tracking.
Experience coordinating remediation with system administrators, developers, vendors, and business stakeholders; validating corrective actions and tracking remediation to closure.
Experience supporting endpoint, network, identity, application, and cloud security controls.
Knowledge of and familiarity with artificial intelligence governance and emerging technology risk.
Ability to manage multiple priorities, work independently, and collaborate as part of a team.

Nice To Haves

Coursework in cybersecurity, information systems, computer science, or a related field.
Professional certifications such as Security+, CISSP, CISM, CRISC, GISP, GCCC, or similar credentials.
Experience supporting compliance with Commonwealth security standards, policies, and procedures, including SEC530.
Knowledge of NIST Cybersecurity Framework, NIST SP 800-53, and CIS Controls.
Considerable experience supporting audit remediation, information security, risk, compliance, and enterprise cybersecurity initiatives.
Considerable experience developing and delivering security awareness and role-based cybersecurity training.
Experience with Microsoft 365, Azure, and cloud security technologies.

Responsibilities

Review, update, and administer security monitoring and incident-tracking procedures.
Proactively manage and examine system security logs and provide timely responses to potential issues.
Provide security design guidance for agency projects.
Assist with disaster recovery and business continuity planning and cybersecurity training.
Create departmental efficiencies and improve security information gathering and response.
Coordinate remediation activities, validate corrective actions, and track remediation to closure.
Elevate governance, risk assessment, and compliance procedures concerning information system security.
Coordinate audit responses and remediation tracking with internal and external parties.
Collaborate with system administrators, developers, vendors, business stakeholders, and technical and non-technical staff.
Serve as backup to the Information Security Officer during absences or delegated assignments.