Security Governance & Compliance Analyst II

Novalink Solutions LLC; Richmond (VA); Remote; USD 110,000 - 140,000; Full time

Job summary

Novalink Solutions LLC in Richmond, VA seeks an IT Security Governance professional to lead risk assessments, privacy reviews, and control frameworks across enterprise systems and vendors. You will collaborate with system and data owners to document security plans, maintain evidence, and ensure authorization and audit readiness.

The role requires interpreting NIST, CIS Controls, HIPAA, CJIS/VCIN requirements, and DoD STIGs, coordinating governance activities, and producing executive reporting on

Qualifications

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Responsibilities

• Conduct and coordinate risk assessments, BIAs, data classifications, privacy reviews, and control assessments for systems and initiatives.
• Maintain risk registers, evidence, remediation plans, and follow-up in Archer GRC and other tools.
• Apply NIST, CIS, HIPAA, CJIS/VCIN, and privacy obligations to programs.
• Partner with owners to establish ownership, classify information, and document security plans.
• Review vendor security documentation and identify gaps and escalation needs.
• Support governance of data-sharing agreements and access-control requirements.
• Coordinate audits, collect evidence, and track corrective actions to closure.
• Develop and communicate security policies, standards, and templates.
• Support security awareness and training for stakeholders.
• Perform governance reviews for AI initiatives; document outcomes and handoffs.
• Assist with continuity, incident response, disaster recovery planning.
• Prepare executive reporting on governance workload, risks, and program priorities.
• Provide security guidance to project teams and vendors; escalate unresolved risk.
• Participate in incident governance activities and post-incident reviews.
• Perform other related duties to support IT Security Governance.

Skills

Governance knowledge

Risk management

Compliance

Documentation

Communication

Auditing

NIST 800-53

Vendor risk management

Job description

Novalink Solutions LLC in Richmond, VA seeks an IT Security Governance professional to lead risk assessments, privacy reviews, and control frameworks across enterprise systems and vendors. You will collaborate with system and data owners to document security plans, maintain evidence, and ensure authorization and audit readiness.

The role requires interpreting NIST, CIS Controls, HIPAA, CJIS/VCIN requirements, and DoD STIGs, coordinating governance activities, and producing executive reporting on