Cybersecurity Risk Analyst

MasterApp Labs LLC; Richmond (VA); Hybrid; USD 69,000 - 124,000; Part time

Benefits offered by this job

401(k) matching

Dental insurance

Health insurance

Vision insurance

Job summary

MasterApp Labs LLC in Richmond, VA seeks a Cybersecurity Risk Analyst (contract) to assess governance, risk, and compliance across programs. You will analyze controls against NIST 800-53, CJIS, HIPAA, and other standards, prepare risk reports, and support audit activities.

The role requires collaborating with executives, IT teams, vendors, and auditors; you will develop risk registers, security plans, and executive summaries while managing multiple assessments under deadlines.

Qualifications

• 5+ years in cybersecurity/GRC roles with hands-on risk assessments.
• Experience applying NIST SP 800-53 and related controls.
• Experience conducting security control assessments and IT audits.
• Experience developing risk registers, assessment reports, and executive summaries.

Skills

Cybersecurity governance

Risk management

Compliance

Privacy

Third-party risk

Audit practices

Executive reporting

Communication with executives

Tools

Archer GRC

VITA SEC530

SOC reports

Job description

Benefits:

• 401(k) matching
• Dental insurance
• Health insurance
• Vision insurance

Title:

Cybersecurity Risk Analyst

Location:

Richmond, VA, (Remote)-Report on site for meetings as needed.

Position Type:

Contract

Interview Mode:

In-person Only

Knowledge Skills and Abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Desired Qualifications

These qualifications would strengthen a candidate's application but would not be mandatory.

Experience and Skills

• Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
• VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
• Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
• Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
• Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
• Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.
• Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
• AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
• Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

Certification | Relevance

CRISC | Enterprise risk management and control assessment

CISA | Information systems auditing and compliance

CGRC | Governance, risk, and compliance

CISSP | Broad cybersecurity knowledge and risk management

CISM | Information security governance and program management

3. Recommended Screening Priorities

• Priority | Qualification | Experience
• 1 | Cybersecurity GRC | 5+ years overall security experience
• 2 | NIST 800-53 / Control Assessments | 4+ years
• 3 | Security Auditing and Compliance | 3+ years
• 4 | Risk Registers and Remediation | 3+ years
• 5 | Archer GRC | 3+ years preferred
• 6 | VITA SEC530 | 2+ years preferred

Required/Desired Skills

• Skill | Required /Desired | Amount | Actual Years of Experience
• experience in cybersecurity, information security, IT security governance, or risk management. | Required | 5 |
• experience performing security risk assessments, compliance reviews, or GRC activities. | Required | 3 |
• experience applying NIST security frameworks, including NIST SP 800-53. | Required | 4 |
• experience conducting security control assessments and supporting IT audits. | Required | 3 |
• experience maintaining risk registers, documenting findings, and tracking corrective actions. | Required | 3 |
• Experience developing security documentation, policies, procedures, assessment reports, and executive summaries. | Required | 3 |
• Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership. | Required | 3 |
• Ability to manage multiple security assessments, compliance activities, and competing deadlines. | Required | 3 |

Flexible work from home options available.