IT Security Risk and Compliance Analyst

Virginia Polytechnic Institute and State University (VT); Blacksburg (VA); On-site; USD 80,000 - 94,000; Full time

Job summary

Virginia Tech is seeking an IT Security Risk and Compliance Analyst to perform security assessments and risk reviews for university departments, including evaluations of third-party solutions for compliance with policies and standards.

The role supports documentation, automation initiatives, and outreach to the university community, with on-site work in Blacksburg, VA and occasional collaboration across IT services.

Qualifications

• Masters degree or equivalent required.
• Demonstrated experience performing IT security reviews, risk assessments, or audits.
• Knowledge of security frameworks and standards (NIST, PCI-DSS, ISO 27001, CIS, NIST CSF).
• Ability to communicate across a broad range of campus audiences.
• Experience with automation and scripting to improve data consistency.

Responsibilities

• Conduct IT security assessments and risk reviews for university departments.
• Evaluate third-party technology solutions for compliance with university policies.
• Develop asset inventories and assess security controls and configurations.
• Create and maintain IT Risk and Compliance program documentation and procedures.
• Coordinate updates to the IT Continuity of Operations plan and assist disaster recovery efforts.
• Provide security training and outreach to the university community.

Skills

IT security reviews

Risk assessments

Security concepts

Awareness training

Cross-team communication

Education

Master's degree or equivalent

Tools

GRC tools

Python

PowerShell

Bash

Job description

Job Description

Under the guidance of the Associate Director of IT Risk and Compliance, the IT Security Risk and Compliance Analyst will carry out IT security assessment activities including IT risk assessments and security reviews for university departments, as well as evaluations of third-party technology solutions, to ensure alignment with university policies, standards, and external compliance regulations wherever applicable. Assessment activities may include a wide variety of tasks depending on the scope of the review and the IT capabilities within university departments (e.g., developing asset inventory, assessing endpoint and application security controls and configurations, examining procedures, etc.).
The analyst will be expected to contribute to the creation and maintenance of documentation/procedures in support of the IT Risk and Compliance program and to identify opportunities to leverage automation to enhance data consistency and process efficiency within the program and across other university IT services. The analyst may provide training and outreach to the university community as needed and may also be called on to coordinate updates for the IT Continuity of Operations plan and to assist units within the Division of Information Technology as they conduct disaster recovery planning or on other security-related initiatives as requested.

Required Qualifications

• Master's degree, or a combination of education, training, and progressive experience that equates to a Master's degree.
• Demonstrated experience performing IT security reviews, risk assessments, or audits
• Strong understanding of key information security concepts and fundamentals
• Experience in creating awareness of security practices across multiple technical teams
• Knowledge of security frameworks and standards, including NIST, PCI-DSS, ISO 27001, CIS Critical Security Controls, NIST Cybersecurity Framework (NIST CSF), etc.
• Ability to effectively communicate across a broad range of campus audiences
• Exceptional organizational and time-management skills

Preferred Qualifications

• Professional certification such as CISA, CISM, CRISC, or CISSP
• Experience performing security assessments of SaaS services
• Knowledgeable of relevant compliance regulations (e.g., FERPA, GLBA)
• Experience with GRC and Information security tools/technologies to collect and maintain security and risk information
• Experience with automation using common scripting tools (e.g., Python, PowerShell, Bash, etc.)
• Experience with data analysis and manipulation
• Experience managing IT security risk or compliance in a higher education setting

Work Location

Candidates must be available for on-site work in Blacksburg, VA as needed, with at least one on-site day per week.

Overtime Status

Exempt: Not eligible for overtime

Appointment Type

Regular

Salary Information

$80,000 - $94,000

Hours per week

40

Review Date

9/24/2026

Additional Information

Sponsorship is not available for this role.

The successful candidate will be required to have a criminal conviction check.

About Virginia Tech

Dedicated to its motto,Ut Prosim(That I May Serve), Virginia Tech pushes the boundaries of knowledge by taking a hands-on, transdisciplinary approach to preparing scholars to be leaders and problem-solvers. A comprehensive land-grant institution that enhances the quality of life in Virginia and throughout the world, Virginia Tech is an inclusive community dedicated to knowledge, discovery, and creativity. The university offers more than 280 majors to a diverse enrollment of more than 36,000 undergraduate, graduate, and professional students in eight undergraduate colleges, a school of medicine, a veterinary medicine college, Graduate School, and Honors College. The university has a significant presence across Virginia, including Blacksburg, the greater Washington, D.C. area, the Health Sciences and Technology Campus in Roanoke, sites in Newport News and Richmond, and numerous Extension offices and research institutes. A leading global research institution, Virginia Tech conducts more than $650 million in research annually.

Virginia Tech does not discriminate against employees, students, or applicants on the basis of age, color, disability, sex (including pregnancy), gender, gender identity, gender expression, genetic information, ethnicity or national origin, political affiliation, race, religion, sexual orientation, or military status, or otherwise discriminate against employees or applicants who inquire about, discuss, or disclose their compensation or the compensation of other employees or applicants, or on any other basis protected by law.

If you are an individual with a disability and desire an accommodation, please contact IT Human Resources at [e-mail] during regular business hours at least 10 business days prior to the event.