IT Risk Manager #W0115

Department of Social Service; Richmond (VA); On-site; USD 121,000 - 130,000; Full time

Job summary

The Virginia Department of Social Services is seeking an IT Risk Manager to lead the risk governance framework, provide strategic direction on information security risk and compliance, and collaborate with Business Owners, System Owners, and IT staff to align risk management with VDSS objectives.

Responsibilities include implementing the VDSS Risk Management Framework, coordinating data classification, IT risk assessments, and quarterly risk treatment plans, while overseeing IT risk staff and

Qualifications

• Advanced IT risk management experience in public or large-scale environments.
• Experience applying federal/state regulations and policies (NIST, SEC520, etc.).
• Proven ability to evaluate security controls in applications.
• Experience performing IT risk assessments and developing risk-based plans.
• Experience with data classifications and risk treatment coordination.
• Experience creating System Security Plans and internal control reviews.
• Ability to translate complex risks into actionable leadership guidance.
• Experience using AI-driven risk management tools.
• Strong project management and cross-functional collaboration skills.

Responsibilities

• Lead (and facilitate) Data Classification with Owners and BCM to determine application sensitivity.
• Perform IT Risk Assessments for VDSS applications per SEC520.
• Coordinate Risk Treatment Plans with System Owners and security teams.
• Develop and oversee System Security Plans and Control Assessments.
• Serve as agency point of contact for IT Risk Management with internal/external entities.

Skills

IT risk management

Regulatory compliance

Security controls assessment

Risk assessments

Data classification

System security plans

Governance & policy

AI-driven risk tools

Project leadership

Tools

GRC tools

Job description

Title: IT Risk Manager #W0115

State Role Title:Info Technology Specialist III

Hiring Range: $121,000 - $130,000 per year (salary commensurate with experience)

Pay Band: 6

Agency: Department of Social Services

Location:DSS HOME OFFICE

Agency Website:https://www.dss.virginia.gov/

Recruitment Type: General Public - G

Job Duties

At the Virginia Department of Social Services, we put people at the center of everything we do. We believe that every Virginian can live a life of dignity and that all voices, ideas and experiences contribute greatly to our pursuit of excellence. Inspired by continuous improvement, we commit ourselves to listening, learning and cultivating environments of trust, respect and positive engagement. Together, we are mission-driven, eager to achieve, and passionate about bringing the best of who we are to those we serve.

We design and deliver high-quality human services that help Virginians achieve safety, independence and overall well-being. We are a $2 billion agency – one of the largest in the Commonwealth of Virginia – partnering with 120 local departments of social services and 31 community action agencies, along with faith-based and non-profit organizations, to promote the well-being of children, adults, and families statewide. We proudly serve alongside 1,650 (state) and 12,200 (local) human services professionals throughout the Social Services System, who ensure that thousands of Virginia’s most vulnerable citizens have easy access to the services and benefits available to them.

The IT Risk Manager is responsible for implementing the VDSS Risk Management Framework and the VITA Information Technology Risk Standard SEC520. The position provides VDSS Information Security and Risk Management leadership, strategic direction and consultation on information security risk and compliance.

The IT Risk Manager leads and facilitates Data Classification with Business Owners, System Owners and the Business Continuity Manager to determine application sensitivity and performs IT Risk Assessments for the all sensitive DSS applications, coordinating with Business Owners, System Owners, and System Administrators to develop a risk-based assessment in accordance with VITA SEC520.

The IT Risk Manager coordinates quarterly Risk Treatment Plans with System Owners and VITA Commonwealth Security and Risk Management.

Further, the IT Risk Manager is responsible for conducting Control Assessments and System Security Plans for each VDSS application.

The IT Risk Manager serves as an agency point of contact for internal and external entities regarding IT Risk Management for VDSS. The position provides VDSS Information Security and Risk Management leadership, strategic direction and consultation on information security risk and compliance and oversees Information Technology and Risk Management staff, including the IT Risk Analysts.

Minimum Qualifications

• Comprehensive, advanced, demonstrated, and supervisory experience in Information Systems, business, or related IT risk management fields.
• Comprehensive, advanced, demonstrated, and supervisory experience in applying complex federal and state statutes, regulations, policies and procedures governing the area of compliance.
• Advanced experience in evaluating and testing security controls within computer applications
• Advanced experience in reviewing and/or writing reports, policies and procedures.
• Comprehensive experience in working on and/or leading projects and teams.
• Comprehensive and advanced experience performing IT Risk Assessments
• Experience in building and implementing software tools
• Experience using or implementing AI-driven governance, risk, and compliance (GRC) tools, or automated risk analytics platforms.

1. Technical and Functional Expertise - Possess a thorough understanding of over SEC530 and other NIST related information security standard security controls across Agency, State, and Federal security frameworks. Experience with developing and updating Risk Assessments, Data Classifications, System Security Plans, Control Assessments, and coordinating Authorities to Operate. Experience or knowledge of system design principles. Ability to gather data from automated and manual sources and through interviews with staff to make risk determinations. Ability to understand state and federal security controls (NIST 800-53A, IRS 1075, CMS MARS-E, SSA, etc.) and determine compliance with those controls.
2. Understanding Business - Understand the overlapping uses of Information Systems to support VDSS and to provide assurance on core business processes in risk management and governance.
3. Results Focused - Issue Data Classifications, Security Impact Analyses, Risk Assessments, System Security Plans, Internal Controls Weakness, Control Assessment evaluations for applications.
4. Interpersonal Communication - Demonstrated ability to communicate effectively both orally and in writing with diverse groups of organizations and people. Ability to translate complex technical risks into clear, actionable information for leadership.
5. Technical and Functional Expertise - High degree of independent judgement. Become proficient in other members security office duties for contingency operations
6. Personal Effectiveness - Willingness to be very flexible, ability to maintain the highest professional standards, and competence to be accurate, thorough, and productive with all work.
7. Project Organization – Experience in planning and organization projects through Jira.
8. Tool adoption - Experience utilizing AI-driven risk management tools to provide solutions to automate risk detection, analyze trends, perform predictive risk modeling, and improve the accuracy and speed of assessments.

Additional Considerations

• Current Security Credentials like CISA, CISM, CISSP, CRISC, etc.
• Experience in state government related to IT risk management, technology governance, audit, or cybersecurity.

Selected candidate(s) must successfully pass a fingerprint-based criminal history background check. A record of criminal history does not automatically bar an applicant from consideration. Employment verification will be conducted to include current/previous supervisory employment reference checks.

VDSS will record information from each new employee’s Form I-9 (Employment Eligibility Verification) into the Federal E-Verify system to confirm identity and work authorization.

VDSS offers excellent health and life insurance benefits, pre-tax spending accounts, state funded Short and Long Term Disability, paid holidays, vacation, tuition assistance, free wellness programs, and a state retirement plan with options for tax-deferred retirement savings including employer matching – Employee Benefits.

The Virginia Department of Social Services (VDSS) is an Equal Opportunity Employer and encourages diversity within its workforce.

VDSS does not provide sponsorship.

This position may be eligible for telework opportunities; availability, hours, and duration will be in accordance with the Commonwealth’s Teleworking policy.

VDSS is an official certified state agency that values the service and experience of our Veterans. As such, Veterans are encouraged to apply and receive preference in the hiring process. AmeriCorps, Peace Corps and other national service alumni also are encouraged to apply. Reasonable accommodations are available to applicants, if requested, during the application and/or interview process.

If you have been affected by Policy 1.30 Layoff as a state employee and possess a valid Interagency Placement Screening Form (Yellow Form) or a Preferential Hiring Card (Blue Card), you must submit this document through the “Virginia Jobs” (PageUp) employment site when you apply.

Contact Information

Name: VDSS – Division of Human Resources

Phone: [e-mail]

Email: [e-mail]

In support of the Commonwealth’s commitment to inclusion, we are encouraging individuals with disabilities to apply through the Commonwealth Alternative Hiring Process. To be considered for this opportunity, applicants will need to provide their AHP Letter (formerly COD) provided by the Department for Aging & Rehabilitative Services (DARS), or the Department for the Blind & Vision Impaired (DBVI). Service-Connected Veterans are encouraged to answer Veteran status questions and submit their disability documentation, if applicable, to DARS/DBVI to get their AHP Letter. Requesting an AHP Letter can be found at AHP Letter or by calling DARS at 800-552-5019.

Note: Applicants who received a Certificate of Disability from DARS or DBVI dated between April 1, 2022- February 29, 2024, can still use that COD as applicable documentation for the Alternative Hiring Process.