InfoSec Risk & Compliance Analyst: Controls & Risk

Performance Food Group (New); Richmond (VA); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Day 1 Health & Wellness Benefits

Employee Stock Purchase Plan

401K Employer Matching

Education Assistance

Paid Time Off

Job summary

Performance Food Group in Richmond, VA is seeking an Information Security Analyst to support information and privacy risk management within the Security Risk team. The role emphasizes regulatory compliance, IT risk management, and third-party risk oversight.

The analyst will help maintain risk registers, assist with risk frameworks for AI, and support governance with cross-functional stakeholders while aligning with SOX, PCI DSS, HIPAA, GDPR, and CCPA requirements.

Qualifications

• Bachelor's degree in a relevant field required.
• Experience performing IT and security risk assessments using qualitative and quantitative methods.
• Knowledge of regulatory requirements and frameworks (SOX, PCI DSS, HIPAA, GDPR, CCPA).
• Experience with Data Classification and Data Loss Prevention.
• Ability to communicate risk to technical and non-technical audiences.

Responsibilities

• Conduct risk assessments and maintain risk register, communicating risk to stakeholders.
• Assist in maintaining security exception lifecycle and compensating controls.
• Develop evaluative risk frameworks for AI and emerging tech.
• Maintain Business Impact Analysis and governance for critical applications.
• Support third party risk management and contractual security requirements.
• Assist in IT audit documentation and governance forums.

Skills

IT risk assessment

Regulatory compliance

Vendor risk mgmt

AI risk evaluation

Privacy laws

SOX

HIPAA

GDPR

CCPA

Azure InfoProtection

MS Office

Education

Bachelor's Degree

Tools

Cloud security controls

Job description

Performance Food Group in Richmond, VA is seeking an Information Security Analyst to support information and privacy risk management within the Security Risk team. The role emphasizes regulatory compliance, IT risk management, and third-party risk oversight.

The analyst will help maintain risk registers, assist with risk frameworks for AI, and support governance with cross-functional stakeholders while aligning with SOX, PCI DSS, HIPAA, GDPR, and CCPA requirements.