Security Analyst

ASCENDING; Richmond (VA); Hybrid; USD 90,000 - 120,000; Full time

Job summary

ASCENDING is seeking an Information Security Analyst for a 1-year, hybrid role in Richmond, VA. You will support governance, risk, compliance, privacy, and security initiatives across programs, systems, and third parties, partnering with stakeholders, legal, and IT to ensure security controls and risk management are in place.

The ideal candidate brings experience with GRC processes, SSPs, risk assessments, and strong communication skills to drive security work across the enterprise.

Qualifications

• 3+ years in information security with emphasis on GRC.
• Strong understanding of information security principles, controls, and risk-management methodologies.
• Experience with security frameworks such as NIST, ISO 27001, or similar.
• Familiarity with SSPs, risk assessments, system diagrams, data flows, and process maps.
• Knowledge of IT infrastructure planning, implementation, and management."
• Experience supporting third-party/vendor risk reviews, contract reviews, or supplier security assessments.
• Excellent written, verbal, and stakeholder communication skills.
• Strong organizational skills, attention to detail, and ability to manage multiple priorities.
• Ability to work independently, meet deadlines, and adapt in changing environments.

Responsibilities

• Maintain and update security, risk, and compliance documentation in a GRC platform.
• Develop and maintain Information System Security Plans (SSPs) with stakeholders.
• Facilitate information-gathering for SSPs, risk assessments, and control evaluations.
• Support information security and privacy initiatives across business units and supplier engagements.
• Represent Security on projects to ensure security and privacy requirements are addressed.
• Collaborate with business teams to identify risks and propose control options.
• Assist in developing and maintaining security policies, standards, and procedures.
• Research industry best practices and applicable security guidance.
• Create and maintain security artifacts, diagrams, and risk templates.
• Review vendor contracts to ensure information security protections.
• Support security awareness and training programs as needed.

Skills

GRC processes

Security frameworks

Stakeholder comms

Risk assessments

Documentation

Vendor risk

Policy development

Tools

GRC platform

Job description

Information Security Analyst

1-Year Contract (potential to extend)

Hybrid – Richmond VA (3 days onsite)

We are seeking an experienced Information Security Analyst to support governance, risk, compliance, privacy, and security initiatives across enterprise programs, systems, applications, and third-party engagements. This role will partner closely with business stakeholders, project teams, legal/privacy teams, and IT to ensure appropriate security controls, documentation, and risk-management practices are in place. The ideal candidate brings strong experience with GRC processes, security frameworks, risk assessments, security documentation, and stakeholder communication.

Key Responsibilities

• Maintain and update security, risk, compliance, and related documentation within a Governance, Risk, and Compliance (GRC) platform.
• Partner with business and technology stakeholders to develop and maintain Information System Security Plans (SSPs).
• Facilitate information-gathering sessions to support SSPs, risk assessments, control evaluations, and other security work products.
• Participate in information security and privacy initiatives across business units, systems, projects, and supplier engagements.
• Represent the Information Security function on project and PMO initiatives to ensure security and privacy requirements are addressed throughout the project lifecycle.
• Collaborate with business teams to understand operational needs, identify security risks, recommend practical control options, and support compliance requirements.
• Assist in developing, maintaining, and improving information security policies, standards, processes, and procedures.
• Research industry best practices and applicable security guidance from reputable sources.
• Create and maintain controls documentation, including system diagrams, process maps, risk assessment templates, and security artifacts.
• Review vendor contracts, agreements, and supporting documentation to help ensure appropriate information security protections are included.
• Support security awareness, education, and other enterprise security initiatives as needed.

Required Qualifications

• Minimum of 3 years of experience in information security, with emphasis on governance, risk, and compliance (GRC).
• Strong understanding of information security principles, practices, controls, and risk-management methodologies.
• Experience working with security frameworks such as NIST, ISO 27001, or similar standards.
• Familiarity with security and privacy documentation, including SSPs, risk assessments, system diagrams, data flows, and process maps.
• Knowledge of IT infrastructure planning, implementation, and management principles.
• Experience supporting third-party/vendor risk reviews, contract reviews, or supplier security assessments.
• Excellent written, verbal, and stakeholder communication skills.
• Strong organizational skills, attention to detail, and ability to manage multiple priorities.
• Ability to work independently, meet deadlines, and adapt effectively in changing or ambiguous environments.

Preferred Qualifications

• Experience using a GRC platform.
• Experience supporting security and privacy programs in a regulated environment.
• Relevant certifications such as Security+, CISSP, CISM, CRISC, ISO 27001, or comparable credentials.
• Experience supporting security awareness and training programs.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or protected veteran status.