Role details

Contract type

Temporary contract

Employment type

Full-time (> 32 hours)

Working hours

Regular working hours

Job source

professionaltechintegration.com

Tech stack

Data Governance Data Sharing Disaster Recovery Information Technology Audit PCI Data Security Standards RSA Archer Platform CIS Benchmarks

Job description

• Risk & Control Assessments: Coordinate and conduct comprehensive security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, and control assessments for new and existing systems, integrations, and enterprise technology initiatives.
• GRC Tool Administration & Tracking: Maintain risk registers, assessment findings, corrective action plans (CAPs), exceptions, and audit evidence within Archer GRC. Track remediation due dates, residual risks, and required leadership decisions through closure.
• Framework Compliance: Interpret and apply enterprise and government standards, including NIST SP 800-53, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI DSS, FERPA, and FTI regulations.
• System & Data Ownership: Partner with data and system owners to establish information classifications, document system security plans (SSPs) and controls, and maintain documentation required for ongoing authority to operate and compliance.
• Third-Party & Interconnection Governance: Review third-party vendor documentation (SOC 1/2 reports, security questionnaires, data flow diagrams, MOUs, MOAs, NDAs) to identify control gaps, establish compensating controls, and ensure compliance with least-privilege and data-handling standards.
• Audit & Oversight Support: Facilitate internal and external audit activities by collecting, validating, and presenting evidence, answering inquiries, and tracking remediation milestones.
• Policy & Program Development: Draft, update, and communicate security policies, standards, procedures, and templates; assist in delivering targeted security awareness and compliance training to system owners and technical teams.
• Emerging Tech & AI Governance: Conduct governance reviews for emerging technology and artificial intelligence initiatives, evaluating business purpose, data sensitivity, privacy risks, and required oversight frameworks.
• Operational Alignment: Support security planning related to business continuity, disaster recovery, incident handling governance, configuration hardening, and identity/access reviews.
• Executive Metrics & Reporting: Prepare security posture metrics, compliance dashboards, risk summaries, and management briefings for leadership.

Requirements

• Strong background in cybersecurity governance, risk management, compliance (GRC), third-party risk management (TPRM), and audit defense.
• Working knowledge of frameworks including NIST 800-53, CIS Controls, CJIS, HIPAA, and state/federal regulatory mandates.
• Proven ability to analyze complex technical architectures, isolate control gaps, and formulate clear, defensible remediation strategies.
• Solid track record maintaining risk registers and compliance workflows in enterprise GRC platforms (such as Archer).
• Practical experience evaluating SOC reports, third-party vendor assessments, and data-sharing agreements.
• Clear communication skills with the ability to interface across technical engineering teams, business leaders, and external auditors., * Experience in cybersecurity, information security, IT security governance, or risk management. (Required 5 Years)
• Experience performing security risk assessments, compliance reviews, or GRC activities. (Required 3 Years)
• Experience applying NIST security frameworks, including NIST SP 800-53. (Required 4 Years)
• Experience conducting security control assessments and supporting IT audits. (Required 3 Years)
• Experience maintaining risk registers, documenting findings, and tracking corrective actions. (Required 3 Years)
• Experience developing security documentation, policies, procedures, assessment reports, and executive summaries. (Required 5 Years)
• Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership. (Required 3 Years)
• Ability to manage multiple security assessments, compliance activities, and competing deadlines. (Required 3 Years)

Benefits & conditions

• Engagement Type: Contract
• Work Arrangement: Remote (Candidate must reside locally in Virginia or within reasonable commuting distance for occasional on-site meetings in Richmond, VA)
• Interview Type: In-Person Only (No exceptions)

Apply for this position

This job is hosted externally. Click below to view the full posting and apply.

Apply on professionaltechintegration.com

Prepare application

• Draft this with your agent
• Open in Claude
• Open in ChatGPT
• Copy prompt