IT Security Governance, Risk & Compliance (GRC) Analyst

Job Description

We are seeking an experienced IT Security Governance, Risk & Compliance (GRC) Analyst to support cybersecurity governance, risk management, regulatory compliance, privacy reviews, third-party risk assessments, and security oversight activities. The ideal candidate will have experience with Archer GRC or similar platforms, NIST security frameworks, VITA SEC530 requirements, security assessments, audit coordination, and risk remediation.

The candidate will work closely with system owners, data owners, IT teams, vendors, auditors, procurement, and executive stakeholders to ensure information systems comply with applicable Commonwealth of Virginia security policies, regulatory requirements, and industry standards.

Key Responsibilities

• Conduct security risk assessments, Business Impact Analyses (BIA), data classification reviews, privacy assessments, control assessments, and security feasibility reviews for applications, systems, integrations, vendors, and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, audit evidence, and remediation tracking in Archer GRC or other approved GRC platforms.
• Interpret and apply VITA SEC530, NIST SP 800-53, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI DSS, FERPA, FTI, and applicable privacy and contractual requirements.
• Partner with system owners and data owners to establish system ownership, classify information, document security controls, maintain security plans, and support authorization and compliance reviews.
• Perform third-party and vendor security risk assessments by reviewing SOC reports, security questionnaires, architecture diagrams, data flows, contracts, MOUs, MOAs, NDAs, and interconnection agreements.
• Review data-sharing agreements and interconnection documentation to ensure appropriate access controls, least-privilege access, data protection, incident notification, privacy safeguards, and annual reviews.
• Coordinate audits, security assessments, compliance reviews, and oversight activities with internal audit, VITA, and other authorized reviewers.
• Collect and validate audit evidence, document findings, track corrective actions, and monitor remediation activities through closure.
• Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes.
• Support security awareness and compliance training programs, including training acknowledgements, completion tracking, reporting, and stakeholder education.
• Conduct security, privacy, and compliance governance reviews for AI and emerging technology initiatives, including vendor assurances, data sensitivity, human oversight, risk identification, and approval requirements.
• Support governance activities related to incident response, disaster recovery, business continuity, access reviews, audit logging, configuration management, security hardening, and vendor management.
• Prepare executive and management reports covering security risks, compliance status, audit findings, remediation progress, system inventory, governance metrics, and program priorities.
• Provide security guidance to technical teams, business units, procurement teams, project managers, vendors, and executive stakeholders.
• Participate in incident and post-incident governance reviews, document control gaps, coordinate privacy and regulatory follow-up, and track corrective actions.

Required Knowledge and Skills

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk management, and audit processes.
• Familiarity with NIST SP 800-53, VITA SEC530, CIS Controls, CJIS, VCIN, HIPAA, PCI DSS, FERPA, FTI, and related security requirements.
• Strong analytical skills to identify security risks, evaluate control gaps, assess residual risk, and recommend remediation actions.
• Experience developing security assessment reports, risk registers, security plans, policies, procedures, audit documentation, and executive briefings.
• Ability to manage multiple projects, coordinate cross-functional stakeholders, meet deadlines, and track remediation commitments.
• Excellent written and verbal communication skills for working with technical teams, management, auditors, vendors, and nontechnical stakeholders.
• Ability to handle sensitive and confidential information with discretion and sound professional judgment.

Preferred Qualifications

• Archer GRC: 3+ years of experience with Archer GRC or comparable governance, risk, and compliance platforms.
• VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
• Third-Party Risk Management: 3+ years reviewing vendor security assessments, SOC reports, security questionnaires, and contractual security requirements.
• Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
• Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, FTI, or comparable regulatory requirements.
• Privacy and Data Sharing: 2+ years reviewing MOUs, data-sharing agreements, interconnection agreements, and security/privacy obligations.
• Incident Response and Business Continuity: 2+ years supporting incident response, disaster recovery, or business continuity governance and compliance.
• AI Security Governance: 1+ year evaluating security, privacy, and compliance risks associated with AI or emerging technologies.
• Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

Preferred Candidate Profile

The ideal candidate is detail-oriented, analytical, and experienced in translating technical security requirements into practical governance and compliance actions. Experience in public-sector cybersecurity, Virginia Commonwealth security requirements, GRC platforms, vendor risk management, audit readiness, and regulatory compliance will be highly valued.