GRC Security Analyst – Hybrid (Richmond, VA)

ASCENDING; Richmond (VA); Hybrid; USD 90,000 - 120,000; Full time

Job summary

ASCENDING is seeking an Information Security Analyst for a 1-year, hybrid role in Richmond, VA. You will support governance, risk, compliance, privacy, and security initiatives across programs, systems, and third parties, partnering with stakeholders, legal, and IT to ensure security controls and risk management are in place.

The ideal candidate brings experience with GRC processes, SSPs, risk assessments, and strong communication skills to drive security work across the enterprise.

Qualifications

• 3+ years in information security with emphasis on GRC.
• Strong understanding of information security principles, controls, and risk-management methodologies.
• Experience with security frameworks such as NIST, ISO 27001, or similar.
• Familiarity with SSPs, risk assessments, system diagrams, data flows, and process maps.
• Knowledge of IT infrastructure planning, implementation, and management."
• Experience supporting third-party/vendor risk reviews, contract reviews, or supplier security assessments.
• Excellent written, verbal, and stakeholder communication skills.
• Strong organizational skills, attention to detail, and ability to manage multiple priorities.
• Ability to work independently, meet deadlines, and adapt in changing environments.

Responsibilities

• Maintain and update security, risk, and compliance documentation in a GRC platform.
• Develop and maintain Information System Security Plans (SSPs) with stakeholders.
• Facilitate information-gathering for SSPs, risk assessments, and control evaluations.
• Support information security and privacy initiatives across business units and supplier engagements.
• Represent Security on projects to ensure security and privacy requirements are addressed.
• Collaborate with business teams to identify risks and propose control options.
• Assist in developing and maintaining security policies, standards, and procedures.
• Research industry best practices and applicable security guidance.
• Create and maintain security artifacts, diagrams, and risk templates.
• Review vendor contracts to ensure information security protections.
• Support security awareness and training programs as needed.

Skills

GRC processes

Security frameworks

Stakeholder comms

Risk assessments

Documentation

Vendor risk

Policy development

Tools

GRC platform

Job description

ASCENDING is seeking an Information Security Analyst for a 1-year, hybrid role in Richmond, VA. You will support governance, risk, compliance, privacy, and security initiatives across programs, systems, and third parties, partnering with stakeholders, legal, and IT to ensure security controls and risk management are in place.

The ideal candidate brings experience with GRC processes, SSPs, risk assessments, and strong communication skills to drive security work across the enterprise.