GRC Security & Compliance Analyst

Remote Jobs; Richmond (VA); On-site; USD 80,000 - 110,000; Full time

Job summary

Remote Jobs in Richmond, VA seeks an IT Security Analyst for a 1-year in-person assignment. The role focuses on governance, risk assessments, compliance with NIST, CJIS, HIPAA, and privacy requirements. You will coordinate with system and data owners, review vendor security, and maintain evidence for audits.

Responsibilities include developing security policies, managing risk registers, and guiding remediation efforts. Strong communication with executives and technical teams is essential.

Qualifications

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Ability to analyze risk, document findings, and support executive decisions.
• Experience with NIST/ CJIS/ HIPAA/ PCI and privacy requirements.
• Ability to prepare security documentation and evidence for audits.

Responsibilities

• Conduct security risk assessments, BIAs, data classifications, and control assessments.
• Maintain risk registers, corrective actions, evidence repositories, and remediation tracking.
• Review vendor security documentation, SOC reports, and third-party risk controls.
• Coordinate governance activities, audits, and compliance with agencies and stakeholders.
• Develop, maintain, and communicate security policies, standards, and templates.
• Support security awareness and training programs for staff and project teams.

Skills

Cybersecurity governance

Risk management

Compliance

Privacy

Third-party risk

Audit practices

Documentation

Stakeholder communication

Incident response

Data sharing governance

Tools

Archer GRC

Job description

Remote Jobs in Richmond, VA seeks an IT Security Analyst for a 1-year in-person assignment. The role focuses on governance, risk assessments, compliance with NIST, CJIS, HIPAA, and privacy requirements. You will coordinate with system and data owners, review vendor security, and maintain evidence for audits.

Responsibilities include developing security policies, managing risk registers, and guiding remediation efforts. Strong communication with executives and technical teams is essential.