IT Security Governance Analyst

IT Security Governance Analyst 

Location: Richmond, VA
Employment Type: 12 Month Contract 
Interview Process: In-person interviews required
100% Remote 
Pay Rate: $44.00 per hour on W2
 

Position Overview

We are seeking an experienced IT Security Governance Analyst to support a large-scale government cybersecurity program. The ideal candidate will have strong experience in Governance, Risk, and Compliance (GRC), NIST security frameworks, risk assessments, security auditing, and regulatory compliance.

This role focuses on strengthening enterprise security governance, managing cybersecurity risks, ensuring regulatory compliance, and collaborating with technical teams, auditors, and leadership.

This is a remote position; however, candidates must reside in Virginia or within reasonable commuting distance for occasional onsite meetings. All interviews will be conducted in person. Candidates must physically reside within the United States throughout the assignment.

Key Responsibilities

• Conduct cybersecurity risk assessments, Business Impact Analyses (BIAs), security control assessments, and compliance reviews.

• Maintain risk registers, security findings, remediation plans, and compliance documentation using Archer GRC or similar platforms.

• Apply security frameworks and standards, including NIST SP 800-53, VITA SEC530, CIS Controls, and applicable regulatory requirements.

• Coordinate internal and external security audits, collect supporting evidence, and track remediation activities through resolution.

• Evaluate third-party and vendor security risks, including SOC reports, security questionnaires, and data-sharing agreements.

• Develop and maintain security policies, procedures, assessment reports, and governance documentation.

• Support privacy, incident response, disaster recovery, and business continuity governance.

• Assess security and compliance risks associated with emerging technologies, including AI.

• Prepare executive-level security reports, risk assessments, compliance metrics, and remediation updates.

• Collaborate with IT teams, business stakeholders, auditors, and leadership to strengthen security controls and regulatory compliance.

Required Qualifications

• 5+ years of experience in cybersecurity, information security, IT governance, or risk management.

• 4+ years of experience applying NIST security frameworks, particularly NIST SP 800-53.

• 3+ years conducting cybersecurity risk assessments, compliance reviews, and GRC activities.

• 3+ years supporting security control assessments and IT audits.

• 3+ years managing risk registers, security findings, remediation plans, and corrective actions.

• Strong understanding of cybersecurity governance, risk management, security controls, and regulatory compliance.

• Experience developing security policies, procedures, risk assessments, and executive-level reporting.

• Excellent communication, analytical, organizational, and stakeholder management skills.

Preferred Qualifications

• Experience with Archer GRC or comparable governance, risk, and compliance platforms.

• Knowledge of VITA SEC530 and Commonwealth of Virginia security requirements.

• Experience with CJIS, VCIN, HIPAA, PCI DSS, FERPA, FTI, or related compliance standards.

• Background in third-party risk management, SOC report reviews, and vendor security assessments.

• Experience conducting Business Impact Analyses, data classification, and privacy reviews.

• Familiarity with AI governance, incident response, disaster recovery, and business continuity.

Preferred Certifications (one or more):

• CRISC – Certified in Risk and Information Systems Control

• CISA – Certified Information Systems Auditor

• CGRC – Certified in Governance, Risk and Compliance

• CISSP – Certified Information Systems Security Professional

• CISM – Certified Information Security Manager

Ideal Candidate

A hands-on cybersecurity governance professional with strong NIST 800-53, risk assessment, audit, and compliance experience. The ideal candidate can independently manage security assessments, identify and communicate risks, track remediation efforts, and work effectively with technical teams and executive leadership.

Important: Candidates must be available for an in-person interview and occasional onsite meetings in Virginia.