IT Security Analyst

vTech Solution; Washington (District of Columbia); Remote; USD 110,000 - 150,000; Full time

Job summary

vTech Solution is seeking an IT Security Analyst 2 to support governance, risk, compliance, privacy, and security assurance activities for a Virginia Department of Corrections program.

The role is primarily remote with occasional on-site meetings in Virginia and requires in-person interviews. Responsibilities include risk assessments, evidence management, and audits to strengthen the agency's security posture.

Qualifications

• 5+ years in cybersecurity, information security, governance, risk, or compliance.
• 3+ years performing security risk assessments, compliance reviews, or GRC activities.
• 4+ years applying NIST security frameworks, including NIST SP 800-53.
• 3+ years conducting security control assessments and supporting IT audits.
• 3+ years maintaining risk registers, findings, and corrective actions.
• 5+ years developing security documentation and executive summaries.
• Strong communication with technical teams, owners, auditors and leadership.
• Knowledge of Virginia security requirements (VITA SEC530) and related standards.
• Ability to handle sensitive information with discretion.

Responsibilities

• Conduct risk assessments, privacy reviews, and control assessments for systems.
• Maintain risk registers, assessment records, and corrective action plans.
• Review vendor security documentation and interconnection agreements.
• Coordinate audits and oversight activities; collect evidence and drive actions to closure.
• Develop and communicate security policies, standards, and governance processes.
• Support security awareness and training for stakeholders.
• Perform governance reviews for emerging technologies and AI initiatives.
• Prepare executive security metrics and compliance reports.

Skills

Security governance

Risk assessment

GRC activities

NIST SP 800-53

Audit support

Policy development

Communication with leadership

Third-party risk

Data privacy

Tools

Archer GRC

Job description

Job Summary

The IT Security Analyst 2 supports the Virginia Department of Corrections by administering and enhancing cybersecurity governance, risk management, compliance, privacy, and security assurance activities. This role involves conducting risk assessments, managing security documentation, ensuring regulatory compliance, and collaborating with various stakeholders to maintain and improve the agency's security posture. The position is primarily remote but requires residence in Virginia or nearby for occasional on-site meetings and mandates in-person interviews.

Responsibilities

• Conduct and coordinate security risk assessments, business impact analyses, data classifications, privacy reviews, and control assessments for systems and technology initiatives.
• Maintain risk registers, assessment records, corrective action plans, and evidence repositories using Archer GRC and other tools.
• Apply and interpret Commonwealth and agency security requirements including VITA SEC530, NIST, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI, FERPA, FTI, and contractual obligations.
• Partner with system and data owners to establish ownership, classify information, document security plans, and maintain evidence for audits and compliance.
• Review vendor and third-party security documentation such as SOC reports, security questionnaires, contracts, and interconnection agreements.
• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security and privacy compliance.
• Coordinate audit and oversight activities, collect and validate evidence, respond to inquiries, and manage corrective actions through closure.
• Develop, maintain, and communicate security policies, standards, procedures, and governance processes.
• Support security awareness and training programs for system owners, technical staff, and stakeholders.
• Perform governance reviews for emerging technologies and AI initiatives, evaluating risks and compliance requirements.
• Assist with security planning for incident response, disaster recovery, business continuity, audit logging, configuration, and access reviews.
• Prepare executive and management reports on governance workload, risks, remediation progress, and compliance status.
• Provide security guidance to project teams, IT operations, procurement, business units, and vendors.
• Participate in incident and post-incident governance activities, including documentation review and corrective action tracking.
• Perform other related duties and special projects supporting IT Security Governance.

Required Skills & Certifications

• 5+ years experience in cybersecurity, information security, IT security governance, or risk management.
• 3+ years experience performing security risk assessments, compliance reviews, or governance, risk, and compliance (GRC) activities.
• 4+ years experience applying NIST security frameworks, including NIST SP 800-53.
• 3+ years experience conducting security control assessments and supporting IT audits.
• 3+ years experience maintaining risk registers, documenting findings, and tracking corrective actions.
• 5+ years experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
• Strong written and verbal communication skills for engaging technical teams, business owners, auditors, and leadership.
• Ability to manage multiple security assessments, compliance activities, and competing deadlines.
• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Familiarity with Commonwealth of Virginia security requirements such as VITA SEC530 and standards including CIS Controls, CJIS, VCIN, HIPAA, PCI, FERPA, and FTI.
• Ability to handle sensitive information with discretion and sound judgment.

Preferred Skills & Certifications

• 3+ years experience using Archer GRC or comparable governance, risk, and compliance platforms.
• 2+ years experience applying Commonwealth of Virginia information security requirements (VITA SEC530).
• 3+ years experience reviewing vendor security documentation, SOC reports, and security questionnaires.
• 3+ years experience conducting business impact analyses, data classification reviews, and security feasibility assessments.
• 3+ years experience working with regulatory compliance frameworks such as CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI.
• 2+ years experience reviewing data-sharing agreements, MOUs, and related security/privacy obligations.
• 2+ years experience supporting incident response, disaster recovery, or business continuity governance.
• 1+ year experience assessing security, privacy, and compliance risks related to emerging technologies and artificial intelligence.
• 3+ years experience preparing executive security metrics, compliance reports, risk summaries, and management briefings.

Special Considerations

• Candidates must reside in Virginia or within reasonable distance to report on-site as needed.
• All interviews are conducted in person with no exceptions.
• Strict adherence to Commonwealth of Virginia security policies prohibiting offshore IT contractors.

Scheduling

• Remote work with potential on-site meetings as required.
• Work schedule details unspecified; flexibility to meet deadlines and coordinate with multiple stakeholders is essential.