IT Security Analyst 2

Tomorrow Hire Llc.; Richmond (VA); Remote; USD 76,000 - 108,000; Full time

Job summary

The Virginia Department of Corrections (DOC) is seeking an IT Security Analyst 2 to support its enterprise cybersecurity program. This remote role focuses on security governance, risk management, compliance, privacy, third-party risk, and audit readiness.

The analyst conducts security assessments, maintains risk documentation, and works with vendors, auditors, and business owners to identify risks and improve security practices. This is a contract position with pay at $66.68 per hour.

Qualifications

• At least 5 years in cybersecurity or risk management.
• At least 4 years applying NIST frameworks (NIST SP 800-53).
• At least 3 years performing risk assessments or GRC activities.
• At least 3 years documenting findings and tracking corrective actions.
• Strong written and verbal communication with technical teams, business owners, auditors, and leadership.

Responsibilities

• Conduct risk assessments, BIAs, data classification reviews, privacy reviews, control assessments, and security feasibility reviews.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and remediation tracking in Archer GRC or other approved tools.
• Apply security frameworks and requirements (NIST, SEC530, CIS Controls, DoD STIGs, CJIS, HIPAA, PCI, FERPA, FTI).
• Coordinate audits and assessments, validate evidence, document findings, respond to inquiries, and track corrective actions to closure.
• Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes.
• Prepare executive reports covering risks, findings, remediation progress, and program priorities.

Skills

Security governance

Risk management

Compliance

NIST SP 800-53

Audit readiness

Communication

Tools

Archer GRC

Job description

Job Title: IT Security Analyst 2
Work Type: Remote
Location: Richmond, VA 23225
Salary/Rate: $66.68/hr
Start Date: November 2, 2026
End Date: October 25, 2027
Industry Category: Information Technology / Cybersecurity
Employment Type: Contract

Overview

The Virginia Department of Corrections (DOC) is seeking an IT Security Analyst 2 to support its enterprise cybersecurity program. This role focuses on security governance, risk management, compliance, privacy, third-party risk, and audit readiness. The analyst will conduct security assessments, maintain risk documentation, support regulatory compliance, and work with technical teams, business owners, vendors, and auditors to identify risks and improve security practices.

Job Description

The IT Security Governance Analyst supports the development, implementation, and improvement of DOC's cybersecurity governance and compliance activities. The position evaluates security risks across systems, applications, services, vendors, and technology initiatives; maintains governance records; reviews security controls and data-sharing agreements; and helps ensure compliance with Commonwealth of Virginia and applicable federal requirements. The analyst also supports security awareness training, emerging technology reviews, audit coordination, executive reporting, and corrective-action tracking.

Responsibilities

• Conduct security risk assessments, Business Impact Analyses (BIAs), data classification reviews, privacy reviews, control assessments, and security feasibility reviews.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and remediation tracking in Archer GRC or other approved tools.
• Apply relevant security frameworks and requirements, including NIST guidance, VITA SEC530, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI, FERPA, and FTI.
• Work with system and data owners to document security plans, assign ownership, classify information, review controls, and maintain audit and authorization evidence.
• Review third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, and interconnection agreements.
• Evaluate data-sharing agreements, MOUs, and related documents for security, privacy, access control, least-privilege, data-handling, and incident-notification requirements.
• Coordinate audits and assessments, validate evidence, document findings, respond to inquiries, and track corrective actions through closure.
• Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes.
• Support security awareness and compliance training, including acknowledgements, tracking, reporting, and stakeholder education.
• Review emerging technology and artificial intelligence initiatives for security, privacy, compliance, data sensitivity, vendor assurances, and required approvals.
• Support governance activities related to incident response, disaster recovery, business continuity, audit logging, system hardening, access reviews, and vendor management.
• Prepare executive and management reports covering security risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide security guidance to project teams, IT operations, procurement, business units, and vendors; facilitate meetings and elevate unresolved risks when needed.
• Support post-incident governance reviews, control-gap identification, regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects as assigned.

Minimum Qualifications

• At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
• At least 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
• At least 3 years of experience performing security risk assessments, compliance reviews, or governance, risk, and compliance (GRC) activities.
• At least 3 years of experience conducting security control assessments and supporting IT audits.
• At least 3 years of experience maintaining risk registers, documenting findings, and tracking corrective actions.
• At least 3 years of experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
• Strong written and verbal communication skills when working with technical teams, business owners, auditors, and leadership.
• Ability to manage multiple security assessments, compliance activities, and competing deadlines.
• Ability to analyze technical and business information, identify control gaps, evaluate residual risk, and recommend practical corrective actions.
• Ability to handle sensitive information with discretion and professional judgment.

Preferred Qualifications

• 3+ years of experience using Archer GRC or a comparable governance, risk, and compliance platform.
• 2+ years of experience applying Commonwealth of Virginia information security requirements, including VITA SEC530.
• 3+ years of experience reviewing vendor security documentation, SOC reports, and security questionnaires.
• 3+ years of experience conducting Business Impact Analyses, data classification reviews, and security feasibility assessments.
• 3+ years of experience working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
• 2+ years of experience reviewing data-sharing agreements, MOUs, and security and privacy obligations.
• 2+ years of experience supporting incident response, disaster recovery, or business continuity compliance.
• 1+ year of experience assessing security, privacy, and compliance risks associated with AI or emerging technologies.
• 3+ years of experience preparing security metrics, compliance reports, risk summaries, and management briefings.

Compensation

• Pay Rate: $66.68 per hour

Schedule

• Remote position, with occasional onsite attendance in Virginia for meetings as needed.

Work Location

• Richmond, VA 23225.