IT Security Analyst 2

We are seeking an experienced IT Security Analyst 2 to support cybersecurity governance, risk management, compliance, privacy, and security assessment activities. The ideal candidate will have experience with Governance, Risk, and Compliance (GRC) platforms, security frameworks, third-party risk assessments, audit coordination, and regulatory compliance. The candidate will work closely with IT teams, business stakeholders, system owners, vendors, and auditors to identify security risks, assess controls, maintain compliance documentation, and support continuous improvement of the organization’s security governance program. Key Responsibilities Conduct security risk assessments, Business Impact Analyses (BIAs), data classification reviews, privacy assessments, and security feasibility reviews for systems, applications, integrations, and technology initiatives. Maintain risk registers, assessment records, corrective action plans, compliance evidence, exceptions, and remediation tracking using Archer GRC or comparable GRC platforms. Apply security frameworks, standards, and regulatory requirements, including NIST, CIS Controls, and applicable information security and privacy requirements. Review and document security controls, system security plans, ownership responsibilities, and compliance evidence to support audits and authorization activities. Conduct third-party and vendor security assessments by reviewing SOC reports, security questionnaires, architecture documents, data flows, contracts, and related agreements. Evaluate data-sharing agreements, Memorandums of Understanding (MOUs), and other interconnection documentation for security, privacy, access control, and data-handling requirements. Coordinate internal and external audits, collect and validate evidence, document findings, and track corrective actions through closure. Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes. Support security awareness and compliance training programs, including tracking acknowledgments and reporting completion status. Assess security, privacy, and compliance risks associated with artificial intelligence (AI) and emerging technologies. Support governance activities related to incident response, disaster recovery, business continuity, audit logging, system hardening, access reviews, and vendor management. Prepare security metrics, risk summaries, compliance reports, executive briefings, and management updates. Communicate security requirements and recommendations to technical teams, business stakeholders, vendors, procurement teams, and auditors. Participate in incident reviews, identify control gaps, and support corrective and preventive action tracking. Required Knowledge and Skills Cybersecurity governance, risk management, compliance, privacy, and audit practices. Security risk assessments, control assessments, Business Impact Analysis, and data classification. Governance, Risk, and Compliance (GRC) tools, preferably Archer GRC or comparable platforms. Security frameworks and standards, including NIST SP 800-53 and CIS Controls. Regulatory and industry compliance requirements, including CJIS, HIPAA, PCI DSS, FERPA, and Federal Tax Information (FTI), as applicable. Third-party risk management, vendor security reviews, SOC reports, and security questionnaires. Security policies, procedures, risk registers, remediation plans, and audit evidence documentation. Data-sharing agreements, privacy reviews, security controls, and access management. Incident response, disaster recovery, business continuity, and security compliance governance. Strong analytical, documentation, organizational, and stakeholder communication skills.

Ability to manage multiple assignments, prioritize deadlines, handle sensitive information, and communicate security risks effectively. Preferred Qualifications 3+ years of experience with Archer GRC or comparable governance, risk, and compliance platforms. 2+ years of experience applying Virginia information security requirements, including VITA SEC530. 3+ years of experience in third-party risk management, vendor security assessments, SOC report reviews, and security questionnaires. 3+ years of experience conducting Business Impact Analyses, data classification reviews, and security feasibility assessments. 3+ years of experience with regulatory compliance requirements such as CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI. 2+ years of experience reviewing data-sharing agreements, MOUs, and security and privacy obligations. 2+ years of experience supporting incident response, disaster recovery, or business continuity governance. 1+ year of experience assessing security, privacy, and compliance risks associated with AI and emerging technologies. 3+ years of experience preparing security metrics, compliance reports, risk summaries, and executive presentations. Additional Information This position focuses on security governance, risk, compliance, and assessment rather than solely hands-on security operations. Candidates with experience in public-sector information security compliance and regulated environments are preferred. Candidates must be available for an in-person interview; no exceptions are permitted.