IT Security GRC Analyst

Position: IT Security Governance Analyst

Location: Richmond, VA (6900 Atmore Drive)

Work Arrangement: Remote (Candidates must reside in Virginia or within a reasonable commuting distance for occasional on-site meetings)

Interview Process: In-Person Only

We are looking for an experienced IT Security Governance Analyst to support and strengthen enterprise cybersecurity operations. In this role, you will lead governance, risk, compliance (GRC), privacy, and security assurance initiatives across enterprise systems, services, and emerging technologies.

• Risk & Compliance Assessments: Perform security risk assessments, Business Impact Analyses (BIAs), data classifications, third-party vendor reviews (SOC reports, MOUs), and compliance audits.

• Framework Management: Apply and interpret key security standards and policies (VITA SEC530, NIST, CIS Controls, CJIS, VCIN, HIPAA, PCI, FERPA, FTI).

• GRC Maintenance: Track remediation commitments, maintain risk registers, and manage audit evidence using Archer GRC and other enterprise tools.

• Policy & AI Governance: Develop security policies, templates, and training. Perform governance reviews for emerging technology and AI initiatives.

• Stakeholder Collaboration: Provide security guidance to IT, business units, and vendors, preparing executive briefings and metrics on risk status.

• Core Cybersecurity & GRC: 5+ years in IT security governance, cybersecurity, or risk management.

• Security Frameworks: 4+ years of hands-on experience applying NIST SP 800 standards.

• Risk Assessments & Audits: 3+ years conducting security risk/control assessments, supporting audits, and tracking corrective actions.

• Documentation & Reporting: 5+ years writing security policies, assessment reports, and executive summaries.

• Communication: 3+ years managing multiple assessments and effectively communicating across technical teams, leadership, and auditors.

• 3+ years: Archer GRC platform experience, Third-Party Risk Management, BIAs, Regulatory Compliance (CJIS/HIPAA/PCI).

• 2+ years: VITA SEC530 compliance, Data-Sharing Agreements (MOUs), Incident Response/Continuity Governance.

• 1+ year: AI & Emerging Technology Governance.

• Must physically reside within the United States.

• Willingness to report on-site in Richmond, VA as needed.

• Ability to attend an in-person interview .