IT Risk Manager — Remote State IT Leader

Department of Social Service; Richmond (VA); On-site; USD 121,000 - 130,000; Full time

Job summary

The Virginia Department of Social Services is seeking an IT Risk Manager to lead the risk governance framework, provide strategic direction on information security risk and compliance, and collaborate with Business Owners, System Owners, and IT staff to align risk management with VDSS objectives.

Responsibilities include implementing the VDSS Risk Management Framework, coordinating data classification, IT risk assessments, and quarterly risk treatment plans, while overseeing IT risk staff and

Qualifications

• Advanced IT risk management experience in public or large-scale environments.
• Experience applying federal/state regulations and policies (NIST, SEC520, etc.).
• Proven ability to evaluate security controls in applications.
• Experience performing IT risk assessments and developing risk-based plans.
• Experience with data classifications and risk treatment coordination.
• Experience creating System Security Plans and internal control reviews.
• Ability to translate complex risks into actionable leadership guidance.
• Experience using AI-driven risk management tools.
• Strong project management and cross-functional collaboration skills.

Responsibilities

• Lead (and facilitate) Data Classification with Owners and BCM to determine application sensitivity.
• Perform IT Risk Assessments for VDSS applications per SEC520.
• Coordinate Risk Treatment Plans with System Owners and security teams.
• Develop and oversee System Security Plans and Control Assessments.
• Serve as agency point of contact for IT Risk Management with internal/external entities.

Skills

IT risk management

Regulatory compliance

Security controls assessment

Risk assessments

Data classification

System security plans

Governance & policy

AI-driven risk tools

Project leadership

Tools

GRC tools

Job description

The Virginia Department of Social Services is seeking an IT Risk Manager to lead the risk governance framework, provide strategic direction on information security risk and compliance, and collaborate with Business Owners, System Owners, and IT staff to align risk management with VDSS objectives.

Responsibilities include implementing the VDSS Risk Management Framework, coordinating data classification, IT risk assessments, and quarterly risk treatment plans, while overseeing IT risk staff and