Remote IT Security & GRC Analyst II

Novalink Solutions; Richmond (VA); Hybrid; USD 85,000 - 115,000; Full time

Job summary

Novalink Solutions in Richmond, VA seeks an IT Security Analyst 2 for a remote/in-person contract role focusing on governance, risk assessments, and compliance management to support agency initiatives.

The candidate will coordinate risk assessments, maintain risk registers, review vendor security documentation, and develop security policies while coordinating with system owners and auditors to ensure timely remediation and ongoing authorization.

Qualifications

• 5+ years of cybersecurity/governance, risk management, or IT security experience.
• Experience applying NIST SP 800-53 and related governance controls.
• Ability to develop security documentation, risk assessments, and executive briefings.
• Strong written and verbal communication with executives, auditors, and technical teams.

Responsibilities

• Conduct and coordinate security risk assessments, business impact analyses, data classifications, privacy reviews and control assessments.
• Maintain risk registers, assessment records, corrective-action plans, and evidence repositories.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, and data-flow information.
• Coordinate governance activities; collect evidence; respond to inquiries; manage remediation through closure with audits and reviewers.
• Develop, maintain, and communicate security policies, standards, and governance processes.
• Provide clear security guidance to project teams and vendors; escalate unresolved risk.

Job description

Novalink Solutions in Richmond, VA seeks an IT Security Analyst 2 for a remote/in-person contract role focusing on governance, risk assessments, and compliance management to support agency initiatives.

The candidate will coordinate risk assessments, maintain risk registers, review vendor security documentation, and develop security policies while coordinating with system owners and auditors to ensure timely remediation and ongoing authorization.