Cybersecurity Risk Analyst

Knowledge Skills and Abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Desired Qualifications

These qualifications would strengthen a candidate's application but would not be mandatory.

Experience and Skills

• Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
• VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
• Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
• Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
• Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
• Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.
• Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
• AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
• Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

Certification	Relevance
CRISC	Enterprise risk management and control assessment
CISA	Information systems auditing and compliance
CGRC	Governance, risk, and compliance
CISSP	Broad cybersecurity knowledge and risk management
CISM	Information security governance and program management

Priority	Qualification	Experience
1	Cybersecurity GRC	5+ years overall security experience
2	NIST 800-53 / Control Assessments	4+ years
3	Security Auditing and Compliance	3+ years
4	Risk Registers and Remediation	3+ years
5	Archer GRC	3+ years preferred
6	VITA SEC530	2+ years preferred

Skill	Required /Desired	Amount	Actual Years of Experience
experience in cybersecurity, information security, IT security governance, or risk management.	Required	5
experience performing security risk assessments, compliance reviews, or GRC activities.	Required	3
experience applying NIST security frameworks, including NIST SP 800-53.	Required	4
experience conducting security control assessments and supporting IT audits.	Required	3
experience maintaining risk registers, documenting findings, and tracking corrective actions.	Required	3
Experience developing security documentation, policies, procedures, assessment reports, and executive summaries.	Required	3
Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership.	Required	3
Ability to manage multiple security assessments, compliance activities, and competing deadlines.	Required	3