> Markdown version of [/jobs/ext/3876073-it-security-governance-analyst](https://www.wearedevelopers.com/jobs/ext/3876073-it-security-governance-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# IT Security Governance Analyst

- **Company:** Professional Technology Integration (PTI)
- **Location:** Richmond, VA, United States (Remote available)
- **Contract:** Temporary contract
- **Skills:** Data Governance, Data Sharing, Disaster Recovery, Information Technology Audit, PCI Data Security Standards, RSA Archer Platform, CIS Benchmarks
- **Published:** October 22, 2026
- **Apply:** https://professionaltechintegration.com/PTICloud9/index.php?option=com_mycareer&job=apply&jpid=18817&Itemid=568

## About the Role

* Strong background in cybersecurity governance, risk management, compliance (GRC), third-party risk management (TPRM), and audit defense.
 * Working knowledge of frameworks including NIST 800-53, CIS Controls, CJIS, HIPAA, and state/federal regulatory mandates.
 * Proven ability to analyze complex technical architectures, isolate control gaps, and formulate clear, defensible remediation strategies.
 * Solid track record maintaining risk registers and compliance workflows in enterprise GRC platforms (such as Archer).
 * Practical experience evaluating SOC reports, third-party vendor assessments, and data-sharing agreements.
 * Clear communication skills with the ability to interface across technical engineering teams, business leaders, and external auditors., * Experience in cybersecurity, information security, IT security governance, or risk management. (Required 5 Years)
 * Experience performing security risk assessments, compliance reviews, or GRC activities. (Required 3 Years)
 * Experience applying NIST security frameworks, including NIST SP 800-53. (Required 4 Years)
 * Experience conducting security control assessments and supporting IT audits. (Required 3 Years)
 * Experience maintaining risk registers, documenting findings, and tracking corrective actions. (Required 3 Years)
 * Experience developing security documentation, policies, procedures, assessment reports, and executive summaries. (Required 5 Years)
 * Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership. (Required 3 Years)
 * Ability to manage multiple security assessments, compliance activities, and competing deadlines. (Required 3 Years)

## Description

* Risk & Control Assessments: Coordinate and conduct comprehensive security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, and control assessments for new and existing systems, integrations, and enterprise technology initiatives.
 * GRC Tool Administration & Tracking: Maintain risk registers, assessment findings, corrective action plans (CAPs), exceptions, and audit evidence within Archer GRC. Track remediation due dates, residual risks, and required leadership decisions through closure.
 * Framework Compliance: Interpret and apply enterprise and government standards, including NIST SP 800-53, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI DSS, FERPA, and FTI regulations.
 * System & Data Ownership: Partner with data and system owners to establish information classifications, document system security plans (SSPs) and controls, and maintain documentation required for ongoing authority to operate and compliance.
 * Third-Party & Interconnection Governance: Review third-party vendor documentation (SOC 1/2 reports, security questionnaires, data flow diagrams, MOUs, MOAs, NDAs) to identify control gaps, establish compensating controls, and ensure compliance with least-privilege and data-handling standards.
 * Audit & Oversight Support: Facilitate internal and external audit activities by collecting, validating, and presenting evidence, answering inquiries, and tracking remediation milestones.
 * Policy & Program Development: Draft, update, and communicate security policies, standards, procedures, and templates; assist in delivering targeted security awareness and compliance training to system owners and technical teams.
 * Emerging Tech & AI Governance: Conduct governance reviews for emerging technology and artificial intelligence initiatives, evaluating business purpose, data sensitivity, privacy risks, and required oversight frameworks.
 * Operational Alignment: Support security planning related to business continuity, disaster recovery, incident handling governance, configuration hardening, and identity/access reviews.
 * Executive Metrics & Reporting: Prepare security posture metrics, compliance dashboards, risk summaries, and management briefings for leadership.