IT Security Governance Analyst :: Richmond, VA (Remote)

IT Security Governance Analyst

Location: Richmond, VA (Remote)

Duration: 12 Months

Seeking for an IT Security Governance Analyst and play a crucial role in maintaining and enhancing our security posture. This remote role requires candidates to be within a reasonable distance of Virginia for occasional on-site meetings.

Responsibilities:

• Conduct security risk assessments, Business Impact Analyses, data classifications, and privacy reviews.
• Maintain risk registers, assessment records, corrective-action plans, and follow-up activities.
• Apply and interpret security requirements and standards like NIST, CIS Controls, and more.
• Collaborate with system and data owners to document security plans and maintain compliance evidence.
• Review vendor security documentation and identify gaps and escalation needs.
• Coordinate audit and oversight activities and manage corrective actions.
• Develop and communicate security policies, standards, and governance processes.
• Support the agency's security awareness and training program.
• Assist with security planning for continuity, incident response, and disaster recovery.
• Prepare executive and management reports on governance workload and compliance status.
• Provide security guidance to project teams, IT, procurement, and vendors.
• Participate in incident and post-incident governance activities.

Knowledge, Skills, and Abilities:

• Strong knowledge of cybersecurity governance, risk management, and compliance practices.
• Familiarity with security frameworks and standards like NIST 800-53, HIPAA, PCI, and others.
• Ability to analyze information, identify risks, and recommend actions.
• Proficiency in developing and maintaining professional documentation.
• Excellent communication skills with various stakeholders.
• Ability to handle sensitive information with discretion and sound judgment.

Must-Have Experience and Skills:

• 5 years in cybersecurity, information security, IT security governance, or risk management.
• 3 years performing security risk assessments, compliance reviews, or GRC activities.
• 4 years applying NIST security frameworks, including NIST SP 800-53.
• 3 years conducting security control assessments and supporting IT audits.
• 3 years maintaining risk registers and tracking corrective actions.
• 5 years developing security documentation and executive summaries.
• 3 years of strong written and verbal communication skills.
• 3 years managing multiple security assessments and compliance activities.