IT Compliance Analyst

Commonwealth of VA Careers; Virginia (MN); On-site; USD 95,000 - 105,000; Full time

Job summary

Northern VA Community College in Fairfax County seeks an IT Compliance Analyst to protect digital assets by implementing and monitoring cybersecurity controls and compliance processes. This role ensures IT systems, data practices, and policies meet federal and state regulations and industry standards.

Responsibilities include policy management, third-party risk, risk assessments, security training, and privacy impact assessments, with a focus on FERPA, HIPAA, PCI DSS, GLBA, and CIS Controls.

Qualifications

• Knowledge of cybersecurity policies, standards, and compliance practices.
• Understanding of FERPA, HIPAA, PCI DSS, GLBA, and CIS Controls.
• Ability to review and update policies with version control.
• Experience collecting and validating compliance evidence (e.g., SOC 2, questionnaires).
• Experience delivering security awareness and training programs.

Responsibilities

• Regulatory Compliance & Policy Management: review and version-control cybersecurity policies and documentation.
• Vendor & Third-Party Risk Management: update TPRM policies and processes.
• Cybersecurity Assessments & Internal Controls: track gaps and prepare readiness reports for IT leadership.
• Security Awareness & Compliance Training: develop/deliver training programs and track completion.
• Risk Management & Data Privacy: conduct IT risk assessments and Privacy Impact Assessments.

Skills

Technical reporting

IT cybersecurity

Analytical skills

Cross-functional collaboration

Training program development

Education

Certifications: CompTIA Security+, CompTIA Project+, ITIL 4 Foundation

Tools

KnowBe4

MS Attack Simulator

CIS CSAT

TeamDynamix

Job description

Title: IT Compliance Analyst

Agency: Northern VA Community College

Location: Fairfax County - 059

FLSA: Exempt

Hiring Range: $95,000 - $105,000

Full Time or Part Time: Full Time

Additional Detail

Job Description:

General Description:

The IT Compliance Analyst is responsible for protecting the organization's digital assets by implementing, monitoring, and maintaining robust cybersecurity controls, systems, and compliance processes. This role ensures that the institution’s information technology systems, processes, and data practices comply with applicable federal and state regulations, industry standards, and institutional policies.

Duties and Responsibilities:

• Regulatory Compliance & Policy Management: Performs regular reviews, updates, and version control of cybersecurity policies, procedures, standards, guidelines, and supporting documentation.
• Vendor & Third-Party Risk Management (TPRM): Review, update, and maintain Third-Party Risk Management (TPRM) policies and processes.
• Cybersecurity Assessments & Internal Controls Preparedness: Track gaps in Internal Controls, ensuring timely follow-up by responsible parties, and prepare readiness reports for senior IT leadership.
• Security Awareness & Compliance Training: Develop and deliver IT compliance and data privacy training programs (e.g., FERPA, cybersecurity awareness); and track completion rates institution wide.
• Risk Management & Data Privacy: Conduct periodic IT risk assessments and Privacy Impact Assessments

Minimum Qualifications:

KSA Requirements:

• Knowledge, and a capability for clear, concise technical reporting and cross-functional collaboration.
• Knowledge of IT cybersecurity and privacy principles, including the control requirements of FERPA, HIPAA, PCI DSS, GLBA, and CIS Controls.
• Demonstrated analytical skills and attention to detail in reviewing cybersecurity policies, procedures, and standards; conducting maturity and risk assessments; and managing supporting compliance evidence.
• Ability to collaborate with technical teams, vendors, and third-party providers to validate controls and collect compliance evidence (e.g., HECVAT questionnaires, SOC 2 / reports) in support of the Third-Party Risk Management program.
• Ability to administer security awareness and compliance training programs, including phishing simulations and institution-wide campaigns, and to track completion across the organization.

Minimum Work Experience:

• Experience in cybersecurity operations, IT security analysis, risk management, or compliance enforcement.
• Experience implementing and aligning controls with major security frameworks (e.g., NIST CSF, CIS Controls, PCI DSS, FERPA, HIPAA).
• Hands-on experience using security, compliance, or administrative tools (e.g., KnowBe4, MS Attack Simulator, CIS CSAT, TeamDynamix)

Additional Considerations:

• Experience working within a higher education institution or public sector environment.
• One or more professional certifications such as CompTIA Security+, CompTIA Project+ or ITIL 4 Foundation.
• Familiarity with GRC (Governance, Risk, and Compliance) platforms or learning management systems (e.g., Canvas).