IT Security Analyst Richmond,VA Remote Duties & Responsibilities Risk & Control Assessments: Conduct security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, and technology initiatives. GRC Platform Management: Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities using Archer GRC or similar governance tools. Track remediation commitments, due dates, residual risk, and executive decisions. Framework Compliance: Apply and interpret industry security frameworks and standards, including NIST guidance, CIS Controls, DoD STIGs, and applicable regulatory requirements such as HIPAA, PCI DSS, FERPA, and privacy obligations. Asset & Data Governance: Partner with system and data owners to establish ownership, classify information, document security plans, complete periodic reviews, and maintain compliance evidence. Third-Party Risk Management (TPRM): Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow diagrams, contracts, MOUs, and NDAs to identify gaps, compensating controls, and escalation needs. Data-Sharing & Interconnection Support: Review data-sharing agreements and MOUs for security, privacy, least-privilege, data-handling, access-control, and incident-notification requirements. Audit Coordination: Coordinate internal and external audit activities, validate evidence, document findings, and manage corrective actions through closure. Policy & Documentation: Develop, maintain, and communicate security policies, standards, procedures, guidelines, and templates. Security Awareness: Support the security awareness and training program, including targeted compliance training, tracking, and education for stakeholders. Emerging Tech & AI Governance: Perform governance reviews for emerging technology and artificial intelligence (AI) initiatives, evaluating business purpose, data sensitivity, privacy, security, and vendor assurances. Continuity & Incident Support: Assist with security planning for business continuity, disaster recovery, incident response, audit logging, and configuration hardening. Executive Reporting: Prepare accurate executive and management reports on governance workload, system inventory, risk metrics, and remediation progress. Stakeholder Collaboration: Provide clear security guidance to project teams, technical staff, procurement, and vendors while facilitating professional communication across business units. Knowledge, Skills, and Abilities Deep knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices. Proficiency with security frameworks and standards such as NIST 800-53, CIS Controls, HIPAA, PCI, and FERPA. Strong analytical ability to evaluate technical and business information, distinguish control gaps from acceptable residual risk, and recommend defensible actions. Excellent documentation skills for creating assessment reports, risk registers, security plans, and executive briefings. Strong organizational skills to manage multiple complex assignments and prioritize work under deadlines. Exceptional communication skills for interacting with technical teams, executives, vendors, and business partners. Desired Qualifications & Experience Archer GRC: 3+ years of experience using Archer or comparable GRC platforms. NIST & Control Assessments: 4+ years applying NIST guidelines and conducting security control assessments. Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires. Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments. Regulatory Compliance: 3+ years working with HIPAA, PCI DSS, FERPA, or equivalent regulatory standards. Privacy & Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and privacy obligations. Incident Response & Continuity: 2+ years supporting incident response, disaster recovery, or business continuity compliance. AI & Emerging Tech Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies. Executive Reporting: 3+ years preparing security metrics, compliance reports, and management briefings. Preferred Certifications CRISIS / CRISC: Enterprise risk management and control assessment CISA: Information systems auditing and compliance CGRC: Governance, risk, and compliance CISSP: Broad cybersecurity knowledge and risk management CISM: Information security governance and program management