IT Security Governance Analyst
Location: Richmond, VA (Remote)
Duration: 12 Months
Seeking for an IT Security Governance Analyst and play a crucial role in maintaining and enhancing our security posture. This remote role requires candidates to be within a reasonable distance of Virginia for occasional on-site meetings.
Responsibilities:
- Conduct security risk assessments, Business Impact Analyses, data classifications, and privacy reviews.
- Maintain risk registers, assessment records, corrective-action plans, and follow-up activities.
- Apply and interpret security requirements and standards like NIST, CIS Controls, and more.
- Collaborate with system and data owners to document security plans and maintain compliance evidence.
- Review vendor security documentation and identify gaps and escalation needs.
- Coordinate audit and oversight activities and manage corrective actions.
- Develop and communicate security policies, standards, and governance processes.
- Support the agency's security awareness and training program.
- Assist with security planning for continuity, incident response, and disaster recovery.
- Prepare executive and management reports on governance workload and compliance status.
- Provide security guidance to project teams, IT, procurement, and vendors.
- Participate in incident and post-incident governance activities.
Knowledge, Skills, and Abilities:
- Strong knowledge of cybersecurity governance, risk management, and compliance practices.
- Familiarity with security frameworks and standards like NIST 800-53, HIPAA, PCI, and others.
- Ability to analyze information, identify risks, and recommend actions.
- Proficiency in developing and maintaining professional documentation.
- Excellent communication skills with various stakeholders.
- Ability to handle sensitive information with discretion and sound judgment.
Must-Have Experience and Skills:
- 5 years in cybersecurity, information security, IT security governance, or risk management.
- 3 years performing security risk assessments, compliance reviews, or GRC activities.
- 4 years applying NIST security frameworks, including NIST SP 800-53.
- 3 years conducting security control assessments and supporting IT audits.
- 3 years maintaining risk registers and tracking corrective actions.
- 5 years developing security documentation and executive summaries.
- 3 years of strong written and verbal communication skills.
- 3 years managing multiple security assessments and compliance activities.