IT Security Analyst 2

Job Description

Job Description

Ampcus Inc. is a certified global provider of a broad range of Technology and Business consulting services. We are in search of a highly motivated candidate to join our talented Team.

 

Job Title: IT Security Analyst 2

Location(s): Richmond, VA
(Remote)

Job Summary
The IT Security Governance Analyst supports the enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities.

Work Arrangement

• Remote position.
• Candidates should reside in Virginia or within a reasonable distance to report onsite for meetings as needed.
• All interviews are in person, with no exceptions.

Responsibilities

• Conduct and coordinate security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
• Apply and interpret applicable security requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.
• Partner with system and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence for authorization, audits, and ongoing compliance.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and interconnection documentation. Identify gaps, conditions, compensating controls, and escalation requirements.
• Review interconnection and data-sharing agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
• Coordinate audits, assessments, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit teams and authorized reviewers.
• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend improvements to strengthen compliance and reduce risk.
• Support security awareness and training programs, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
• Conduct governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals. Document outcomes and handoffs.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
• Prepare executive, management, and Commonwealth reports covering governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risks or noncompliance through established channels.
• Participate in incident and post-incident governance activities, including documentation reviews, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects in support of the IT Security Governance program.

Required Knowledge, Skills, and Abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards, including NIST SP 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risks, distinguish control gaps from acceptable residual risks, and recommend clear, defensible actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on activities involving multiple stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Desired Qualifications

• The following qualifications are preferred but not mandatory.
• Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
• VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
• Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
• Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
• Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
• Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security and privacy obligations.
• Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
• AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
• Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

Skills:

SkillRequired / DesiredAmountof ExperienceExpertise RatingMove experience in cybersecurity, information security, IT security governance, or risk management.Required5Years experience performing security risk assessments, compliance reviews, or GRC activities.Required3Years experience applying NIST security frameworks, including NIST SP 800-53.Required4Years   experience conducting security control assessments and supporting IT audits.Required3Years experience maintaining risk registers, documenting findings, and tracking corrective actions.Required3Years 6.Experience developing security documentation, policies, procedures, assessment reports, and executive summaries.Required5Years Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership.Required3Years Ability to manage multiple security assessments, compliance activities, and competing deadlines.Required3Years

Ampcus is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veterans or individuals with disabilities.