IT Security Analyst

Global Sumi Technologies Inc.,; Richmond (VA); On-site; USD 90,000 - 120,000; Full time

Job summary

Global Sumi Technologies Inc. is seeking an IT Security Analyst in Richmond, VA to conduct and coordinate risk assessments, BIAs, and privacy reviews for new and existing systems and services.

You will maintain evidence in Archer GRC, classify information, and review third-party security documentation to ensure compliance and governance across the organization. The role supports awareness, training, and incident governance, with a focus on data sharing, security controls, and executive

Qualifications

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Responsibilities

• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools.
• Track remediation commitments, due dates, residual risk, and required executive decisions.
• Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.
• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.
• Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
• Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
• Prepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and elevate unresolved risk or noncompliance through established channels.
• Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects in support of the IT Security Governance program.

Skills

Governance

Risk management

Compliance

Privacy

Third-party risk

Audit practices

Documentation

Job description

Location: Richmond, VA

Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.

• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
  


• Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.
  


• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.
  


• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
  


• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk
  


• Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
  


• Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
  


• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
  


• Prepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
  


• Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and elevate unresolved risk or noncompliance through established channels.
  


• Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
  


• Perform other related duties and special projects in support of the IT Security Governance program.
  

Title: IT Security Analyst

Location: Richmond, VA

Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.

• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
  


• Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.
  


• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.
  


• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
  


• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk
  


• Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
  


• Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
  


• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
  


• Prepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
  


• Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and elevate unresolved risk or noncompliance through established channels.
  


• Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
  


• Perform other related duties and special projects in support of the IT Security Governance program.
  

Knowledge Skills And Abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
  


• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
  


• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
  


• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
  


• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
  


• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
  


• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.
  

Desired Qualifications

Experience and Skills

• Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms
  


• Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
  


• Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
  


• Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
  


• Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.
  


• Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
  


• AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
  


• Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.