DOC IT Security Analyst 2

Contract The IT Security Governance Analyst supports the Virginia Department of Corrections enterprise cybersecurity program by administering and improving governance risk compliance privacy and security assurance activities.

Max vendor rate - 66.68This is a remote role. However DOC has requested that candidates reside in Virginia or within a reasonable distance in the event they need to report on site. They may have them report on site for meetings as needed.

All interviews are in-person with no exceptions.
The statements below describe the principal duties of the position and are not intended to be all-inclusive.


Conduct and coordinate security risk assessments Business Impact Analyses data classifications privacy reviews control assessments and security feasibility reviews for new and existing systems applications services integrations and technology initiatives.


Maintain risk registers assessment records corrective-action plans exceptions evidence repositories and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments due dates residual risk and required executive decisions.


Apply and interpret Commonwealth and agency requirements including VITA SEC530 NIST guidance CIS Controls DoD STIGs CJIS and VCIN requirements and applicable HIPAA PCI FERPA FTI privacy and contractual obligations.


Partner with system owners and data owners to establish ownership classify information document security plans and controls complete periodic reviews and maintain evidence needed for authorization audit and ongoing compliance.


Review vendor and third-party security documentation including SOC reports security questionnaires architecture and data-flow information contracts MOUs MOAs NDAs and other interconnection documentation. Identify conditions gaps compensating controls and escalation needs.


Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security privacy least-privilege data-handling access-control incident-notification and annual-review requirements.


Coordinate audit assessment and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit VITA and other authorized reviewers.


Develop maintain and communicate security policies standards procedures guidelines templates and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.


Support the agency security awareness and training program including targeted compliance training acknowledgements tracking reporting and education for system owners technical staff and other stakeholders.


Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose data sensitivity privacy security human oversight vendor assurances risks and required approvals; document outcomes and handoffs.


Assist with security planning for continuity incident response disaster recovery business continuity audit logging configuration and hardening access reviews vendor management and other control areas.


Prepare accurate executive management and Commonwealth reporting on governance workload system inventory risks findings remediation progress compliance status metrics and program priorities.


Provide clear security guidance to project teams operational IT procurement business units and vendors. Facilitate meetings communicate requirements professionally and escalate unresolved risk or noncompliance through established channels.


Participate in incident and post-incident governance activities as assigned including documentation review control-gap identification privacy or regulatory coordination and corrective-action tracking.


Perform other related duties and special projects in support of the IT Security Governance program.


Knowledge Skills and Abilities


Knowledge of cybersecurity governance risk management compliance privacy third-party risk and audit practices.


Knowledge of security frameworks and standards such as NIST 800-53 VITA SEC530 CIS Controls CJIS and VCIN requirements HIPAA PCI FERPA FTI and related Commonwealth requirements.


Ability to analyze technical and business information identify risk distinguish control gaps from acceptable residual risk and recommend clear defensible actions.


Ability to develop and maintain professional documentation including assessment reports risk registers security plans policies procedures executive briefings and audit evidence.


Ability to manage multiple complex assignments prioritize work under deadlines and follow through on actions involving many stakeholders.


Ability to communicate effectively with executives technical teams vendors auditors and nontechnical business partners.


Ability to handle sensitive information with sound judgment discretion and a service-oriented approach.
Desired Qualifications


These
qualifications would strengthen a candidates application but would not be
mandatory.


Experience
and Skills



Archer GRC: 3
years of experience using Archer or comparable governance risk and
compliance platforms.

VITA SEC530: 2
years of experience applying Commonwealth of Virginia information security
requirements.

Third-Party
Risk Management: 3 years reviewing vendor security documentation SOC
reports and security questionnaires.

Business Impact
Analysis: 3 years conducting BIAs data classification reviews and
security feasibility assessments.

Regulatory
Compliance: 3 years working with CJIS VCIN HIPAA PCI DSS FERPA or
FTI requirements.

Privacy and
Data Sharing: 2 years reviewing data-sharing agreements MOUs and
security/privacy obligations.

Incident
Response and Continuity Governance: 2 years supporting incident response
disaster recovery or business continuity compliance.

AI and Emerging
Technology Governance: 1 year assessing security privacy and compliance
risks associated with emerging technologies.

Executive
Reporting: 3 years preparing security metrics compliance reports risk
summaries and management briefings.

Skill	Required/Desired	Amount	of Experience
experience in cybersecurity information security IT security governance or risk management.	Required	5.0	Years
experience performing security risk assessments compliance reviews or GRC activities.	Required	3.0	Years
experience applying NIST security frameworks including NIST SP 800-53.	Required	4.0	Years
experience conducting security control assessments and supporting IT audits.	Required	3.0	Years
experience maintaining risk registers documenting findings and tracking corrective actions.	Required	3.0	Years
6. Experience developing security documentation policies procedures assessment reports and executive summaries.	Required	5.0	Years
Strong written and verbal communication skills with technical teams business owners auditors and leadership.	Required	3.0	Years
Ability to manage multiple security assessments compliance activities and competing deadlines.	Required	3.0	Years

Required Skills:

experience in cybersecurityinformation securityIT security governanceor risk performing security risk assessmentscompliance reviewsor GRC applying NIST security frameworksincluding NIST SP conducting security control assessments and supporting IT maintaining risk registersdocumenting findingsand tracking corrective developing security documentationpoliciesproceduresassessment reportsand executive written and verbal communication skills with technical teamsbusiness ownersauditorsand to manage multiple security assessmentscompliance activitiesand competing deadlines.