IT Security Governance Analyst

Summit Human Capital; Richmond (VA); Hybrid; USD 41,000 - 55,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) retirement plan

Comprehensive benefits package

Job summary

Summit Human Capital seeks an IT Security Governance Analyst to support a Virginia public sector client, focusing on protecting sensitive information through governance, risk, compliance, privacy and security assurance across diverse systems.

The candidate will leverage information security and risk-management experience to prepare analyses, reports, and stakeholder communications, while coordinating with owners to maintain controls and documentation under deadlines.

Qualifications

• Experience in information security, cybersecurity governance, IT risk management, compliance, audit, privacy, or related IT discipline.
• Ability to prepare clear written analyses, reports, and stakeholder communications.
• Experience applying security policies, standards, and regulatory/contractual requirements.

Responsibilities

• Conduct and coordinate security risk assessments, privacy reviews, and control assessments for systems and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, and evidence repositories.
• Apply Commonwealth and agency requirements including NIST, CIS Controls, HIPAA, PCI, CJIS, FERPA, and contracts.
• Partner with system and data owners to classify information and maintain security plans and controls.
• Review vendor security documentation, identify gaps, and support interconnection and data-sharing governance.
• Develop and communicate security policies, standards, and governance processes.

Skills

Information security

Cybersecurity governance

IT risk management

Compliance

Audit

Privacy

Stakeholder communications

Confidentiality

Education

Security+ (CompTIA)

CISM

CRISC

CISSP

CISA

HCISPP

Tools

Archer GRC

Job description

Summit Human Capital is seeking a highly motivated IT Security Governance Analyst to support our client in Virginia in the public sector with a mission-driven focus on protecting sensitive information. This position has the exciting opportunity to support enterprise cybersecurity governance, risk, compliance, privacy, and security assurance activities across a broad range of systems and stakeholders. The ideal candidate will meet the following criteria:

Requirements

• Considerable experience in information security, cybersecurity governance, IT risk management, compliance, audit, privacy, or a closely related IT discipline
• Working knowledge of security assessment methodologies, control validation, risk documentation, and remediation tracking
• Experience interpreting and applying security policies, standards, and regulatory or contractual requirements
• Demonstrated ability to prepare clear written analyses, reports, and stakeholder communications
• Ability to manage multiple complex assignments and prioritize work under deadlines
• Ability to maintain confidentiality and comply with background and access standards

Desired

• Experience in state government, corrections, criminal justice, public safety, healthcare, or another highly regulated environment
• Experience with Archer GRC or another governance, risk, and compliance platform
• Relevant certifications such as Security Plus, CISM, CRISC, CISSP, CISA, HCISPP, or comparable credentials

Responsibilities

• Conduct and coordinate security risk assessments, Business Impact Analyses, privacy reviews, and control assessments for systems and technology initiatives
• Maintain risk registers, assessment records, corrective-action plans, and evidence repositories in approved agency tools
• Apply and interpret Commonwealth and agency requirements, including NIST, VITA SEC530, CIS Controls, CJIS, HIPAA, PCI, FERPA, and contractual obligations
• Partner with system and data owners to establish ownership, classify information, and maintain security plans and controls
• Review vendor and third-party security documentation, identify gaps, and support interconnection and data-sharing governance
• Develop, maintain, and communicate security policies, standards, procedures, and governance processes
• Support security awareness and training programs for system owners, technical staff, and stakeholders
• Prepare executive, management, and Commonwealth reporting on governance workload, risks, findings, and compliance status

The hourly pay range for this position is $30 – $40, depending on experience, skills, and qualifications.

Benefits:

We offer a comprehensive benefits package, which includes medical, dental, and vision insurance; 401(k)/retirement plan; and other benefits in accordance with applicable laws.