Senior Cybersecurity GRC Analyst

Mbi Llc; Richmond (VA); On-site; USD 100,000 - 140,000; Full time

Job summary

Mbi Llc is seeking an experienced IT Security Governance professional in Virginia to lead risk assessments, policy development, and evidence management for compliance with NIST and state requirements. You will coordinate audits, drive remediation, and partner with system owners to ensure data protection across initiatives.

The role involves working with Archer GRC, analyzing third-party risk, and producing executive reports. Strong communication and documentation skills are essential.

Qualifications

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS/VCIN, HIPAA, PCI, FERPA, FTI, Commonwealth requirements.
• Ability to analyze technical and business information, identify risk, and recommend defensible actions.
• Ability to develop and maintain professional documentation including assessment reports, risk registers, and audit evidence.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical partners.
• Experience with Archer GRC or similar governance, risk, and compliance platforms.

Responsibilities

• Conduct and coordinate security risk assessments, BIAs, data classifications, privacy reviews, and control assessments for systems and initiatives.
• Maintain risk registers, remediation plans, evidence repositories, and follow-up activities in Archer GRC and other tools.
• Apply Commonwealth and agency requirements (NIST, SEC530, HIPAA, CJIS, VCIN) and related obligations.
• Partner with system and data owners to establish ownership, classify information, document security plans and controls, and maintain evidence for authorization and audit.
• Review vendor and third-party security documentation (SOC reports, security questionnaires, MOUs, NDAs) and identify gaps and escalation needs.
• Support governance of interconnection and data-sharing by reviewing MOUs and agreements for security, privacy, and access-control.
• Coordinate audit, assessment, and oversight activities; collect evidence; respond to inquiries; close corrective actions with internal and external reviewers.
• Develop, maintain, and communicate security policies, standards, procedures, and governance processes; recommend improvements.
• Support security awareness/training programs and targeted compliance training for owners, staff, and stakeholders.
• Perform governance reviews for AI initiatives, evaluating purpose, data sensitivity, privacy, security, and approvals.
• Assist with planning for continuity, incident response, disaster recovery, audit logging, hardening, access reviews, and vendor management.
• Prepare executive reporting on governance workload, inventory, risks, remediation, and metrics.
• Provide clear security guidance to project teams and vendors; facilitate meetings and escalate unresolved risk.
• Participate in incident governance activities including documentation review and action tracking.
• Perform other duties supporting the IT Security Governance program.

Skills

Cybersecurity governance

Security frameworks knowledge

Analytical thinking

Documentation

Communication

GRC tooling

Tools

Archer GRC

Job description

Mbi Llc is seeking an experienced IT Security Governance professional in Virginia to lead risk assessments, policy development, and evidence management for compliance with NIST and state requirements. You will coordinate audits, drive remediation, and partner with system owners to ensure data protection across initiatives.

The role involves working with Archer GRC, analyzing third-party risk, and producing executive reports. Strong communication and documentation skills are essential.