Virtual Information Security Officer (GRC Delivery)

Assura, Inc.; Richmond (VA); On-site; USD 80,000 - 110,000; Full time

Job summary

Assura is seeking a Virtual Information Security Officer (VISO) to deliver day-to-day security program work for Assura clients in a delivery role, under supervision. The analyst-level position focuses on executing tasks, supporting assessments, and maintaining client communication while building toward greater responsibility.

The ideal candidate has 3–5 years in cybersecurity/GRC, with familiarity in NIST 800-53 and related frameworks, and experience updating GRC deliverables.

Qualifications

• 3-5 years of relevant experience in cybersecurity, GRC, risk, compliance, audit, or information security.
• Familiarity with at least one regulatory framework (e.g., NIST 800-53, HIPAA, PCI DSS).
• Strong working knowledge of NIST 800-53 across AC, IA, CM, SI, SC, AU, SA, AT.
• Experience updating or developing GRC deliverables (policies, procedures, standards, BIA, IR/DR docs, SSPs, VM plans, TPRM docs).
• Ability to take direction and reliably carry instructions to completion.
• Strong writing, documentation, and client communication skills.
• Independent research and problem-solving when gaps arise.

Responsibilities

• Perform assigned GRC service and planning tasks under direction of a Senior VISO or GRC Director.
• Support security assessments and identify risks, issues, and basic remediation activities under supervision.
• Maintain and develop core deliverables: policies, procedures, standards, BIA, IR/DR docs, SSPs, VM plans, TPRM docs.
• Facilitate client meetings, track follow-ups, and communicate clearly with clients and Assura colleagues.
• Interact directly with clients (once trained) without constant senior intervention.
• Support audit and compliance activities—preparing compliant documentation and remediation plans.
• Deliver client security awareness training within established parameters (e.g., KnowBe4).
• Manage deadlines and quality expectations, including review steps.
• Conduct independent research to close gaps or answer questions before escalation.

Skills

GRC experience

Regulatory knowledge

Audit support

Policy writing

Client communication

Job description

Assura is seeking a Virtual Information Security Officer (VISO) to deliver day-to-day security program work for Assura clients in a delivery role, under supervision. The analyst-level position focuses on executing tasks, supporting assessments, and maintaining client communication while building toward greater responsibility.

The ideal candidate has 3–5 years in cybersecurity/GRC, with familiarity in NIST 800-53 and related frameworks, and experience updating GRC deliverables.