Remote IT Security GRC Analyst — Governance & Compliance

Software Technology Inc; United States; Remoto; USD 90.000 - 120.000; Tempo pieno

Descrizione del lavoro

Virginia Department of Corrections is seeking an IT Security Governance Analyst to support enterprise cybersecurity by administering and improving governance, risk, privacy, and security assurance activities. This is a remote role with occasional on-site meetings in Virginia as needed.

The role conducts risk assessments, maintains risk registers, reviews vendor security, and prepares executive reporting; collaborates with system owners, auditors, and stakeholders to strengthen compliance and

Competenze

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risk, distinguish control gaps from residual risk, and recommend clear actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and coordinate with many stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Mansioni

• Conduct security risk assessments, BIAs, data classifications, privacy reviews, control assessments, and security feasibility reviews for systems and initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved tools.
• Apply and interpret Commonwealth and agency requirements, including NIST guidance, CIS controls, DoD STIGs, CJIS and VCIN, HIPAA, PCI, FERPA, FTI, privacy and contractual obligations.
• Partner with system and data owners to establish ownership, classify information, document security plans and controls, and maintain evidence for authorization and audits.
• Review vendor security documentation (SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs/NDAs) and identify gaps.
• Support interconnection governance by reviewing MOUs and agreements for security, privacy, least-privilege, data-handling, access-control, and incident-notification requirements.
• Coordinate audit, assessment, and oversight activities; collect evidence; respond to inquiries; document findings; and manage corrective actions through closure.
• Develop, maintain, and communicate security policies, standards, procedures, and governance processes; recommend improvements to strengthen compliance and reduce risk.
• Support security awareness and training programs; track training, and provide education for owners, staff, and stakeholders.
• Perform governance reviews for AI initiatives; evaluate purpose, data sensitivity, privacy, security, oversight, vendor assurances, risks, and approvals; document outcomes.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management.

Conoscenze

Archer GRC

VITA SEC530

Third-Party Risk Management

Business Impact Analysis

Regulatory Compliance

Privacy & Data Sharing

Incident Response

AI Governance

Executive Reporting

Descrizione del lavoro

Virginia Department of Corrections is seeking an IT Security Governance Analyst to support enterprise cybersecurity by administering and improving governance, risk, privacy, and security assurance activities. This is a remote role with occasional on-site meetings in Virginia as needed.

The role conducts risk assessments, maintains risk registers, reviews vendor security, and prepares executive reporting; collaborates with system owners, auditors, and stakeholders to strengthen compliance and