Senior Information Security Compliance Analyst (Hybrid)

Commonwealth of VA Careers; Richmond (VA); Hybrid; USD 73,000 - 90,000; Full time

Job summary

Commonwealth of VA Careers in Richmond, VA seeks a Senior Information Security Compliance Analyst to guide security awareness, enforce regulatory-compliant controls, and support IT projects on a hybrid schedule (3 days in office, 2 telework days per week). The role reports to the Information Security and Privacy Officer and involves leading security policy updates and training initiatives.

The position emphasizes risk assessment, incident response readiness, and mentorship for junior staff, with

Responsibilities

• Lead review, development, and updating of information security policies, standards, and procedures to align with regulatory requirements and best practices.
• Create and deliver information security trainings using KnowBe4 platform.
• Develop SCC-wide security awareness programs for employees including phishing prevention and response.
• Implement security controls ensuring adherence to established standards across the organization.
• Conduct risk assessments to identify and evaluate security risks across systems, apps, and processes.
• Identify and recommend mitigation strategies for risk assessments.
• Participate in IT projects, providing information security support and guidance on security requirements.
• Provide advanced technical support for compliance tools and technologies to ensure effective operation.
• Ensure security practices and tools comply with regulations, standards, and frameworks.
• Research emerging threats, technologies and regulatory changes to identify improvement opportunities.
• Provide guidance and mentorship to junior analysts, and assist on-call security needs.

Job description

Senior Information Security Compliance Analyst (Hybrid)

Anticipated Salary Range: $72,946-$90,000

The State Corporation Commission (SCC) seeks a Senior Information Security Compliance Analyst to join the Office of Technology Governance (OTG). Located in downtown Richmond, the SCC is an independent state agency that balances the interests of citizens, businesses, and customers in regulating Virginias business and economic concerns. Reporting to the Information Security and Privacy Officer, the Senior Information Security Compliance Analyst guides SCC employees with the proper use of technology through required information security awareness training, phishing exercises, data classification, and other organization-wide information security and privacy initiatives. This position offers a hybrid work schedule, which includes 3 days in office and 2 telework days each week, as well as a variety of professional development and training opportunities.

Essential Duties and Responsibilities

• Lead the review, development, and updating of information security policies, standards, and procedures to align with government regulatory requirements and industry best practices
• Create, develop, and execute information security trainings using the KnowBe4 training platform
• Develop and conduct SCC-wide security awareness programs for employees, including phishing prevention and response activities, to promote a strong culture of security throughout the organization
• Implement security controls, ensuring adherence to established standards across the organization
• Conduct risk assessments to identify and evaluate security risks across systems, applications, and processes
• Identify and recommend mitigation strategies for risk assessments
• Independently participate in information technology projects including providing information security support and guidance on security requirements, providing technical resolution and configuration requirements for system issues related to IT or security projects, and collaborating with project team members
• Provide advanced technical support for compliance tools and technologies to ensure their effective operation and continuous improvement
• Ensure security practices and tools are in compliance with relevant regulations, standards, and frameworks
• Research and remain up to date with emerging security threats, technologies, regulatory changes, and industry best practices to identify opportunities for improvement
• Provide guidance, training, and mentorship to junior analysts
• Provide security support while on-call, analyze information, and upscale as required
• Perform additional duties as required