> Markdown version of [/jobs/ext/4210167-it-security-governance-analyst](https://www.wearedevelopers.com/jobs/ext/4210167-it-security-governance-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# IT Security Governance Analyst

- **Company:** The Custom Group of Companies
- **Location:** Richmond, VA, United States (Remote available)
- **Experience:** Experienced
- **Salary:** $91,520.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Cyber Security, Information Systems, Data Sharing, Disaster Recovery, Information Technology Audit, IT Management, Internet Security, Information Systems Security Architecture Professional, PCI Data Security Standards, Information Technology Security Auditing, Data Classification, CIS Benchmarks
- **Published:** October 26, 2026
- **Apply:** https://www.careerbuilder.com/job-details/it-security-governance-analyst-richmond-va--f1b9485c-a132-4208-bf48-8063b24887b9

## About the Role

Computer Security, IT Governance, Security Analysis, U.S. National Institute of Standards and Technology (NIST), Risk, Internet Security, Regulatory Compliance, Security Auditing, Computer Security, Government, * 5+ years of experience in cybersecurity, information security, IT governance, or risk management.

 * 4+ years of experience applying NIST security frameworks, particularly NIST SP 800-53.
 * 3+ years conducting cybersecurity risk assessments, compliance reviews, and GRC activities.
 * 3+ years supporting security control assessments and IT audits.
 * 3+ years managing risk registers, security findings, remediation plans, and corrective actions.
 * Strong understanding of cybersecurity governance, risk management, security controls, and regulatory compliance.
 * Experience developing security policies, procedures, risk assessments, and executive-level reporting.
 * Excellent communication, analytical, organizational, and stakeholder management skills., * Experience with Archer GRC or comparable governance, risk, and compliance platforms.
 * Knowledge of VITA SEC530 and Commonwealth of Virginia security requirements.
 * Experience with CJIS, VCIN, HIPAA, PCI DSS, FERPA, FTI, or related compliance standards.
 * Background in third-party risk management, SOC report reviews, and vendor security assessments.
 * Experience conducting Business Impact Analyses, data classification, and privacy reviews.
 * Familiarity with AI governance, incident response, disaster recovery, and business continuity.

Preferred Certifications (one or more):

 * CRISC - Certified in Risk and Information Systems Control
 * CISA - Certified Information Systems Auditor
 * CGRC - Certified in Governance, Risk and Compliance
 * CISSP - Certified Information Systems Security Professional
 * CISM - Certified Information Security Manager, A hands-on cybersecurity governance professional with strong NIST 800-53, risk assessment, audit, and compliance experience. The ideal candidate can independently manage security assessments, identify and communicate risks, track remediation efforts, and work effectively with technical teams and executive leadership.

## Description

We are seeking an experienced IT Security Governance Analyst to support a large-scale government cybersecurity program. The ideal candidate will have strong experience in Governance, Risk, and Compliance (GRC), NIST security frameworks, risk assessments, security auditing, and regulatory compliance.

This role focuses on strengthening enterprise security governance, managing cybersecurity risks, ensuring regulatory compliance, and collaborating with technical teams, auditors, and leadership.

This is a remote position; however, candidates must reside in Virginia or within reasonable commuting distance for occasional onsite meetings. All interviews will be conducted in person. Candidates must physically reside within the United States throughout the assignment., * Conduct cybersecurity risk assessments, Business Impact Analyses (BIAs), security control assessments, and compliance reviews.

 * Maintain risk registers, security findings, remediation plans, and compliance documentation using Archer GRC or similar platforms.
 * Apply security frameworks and standards, including NIST SP 800-53, VITA SEC530, CIS Controls, and applicable regulatory requirements.
 * Coordinate internal and external security audits, collect supporting evidence, and track remediation activities through resolution.
 * Evaluate third-party and vendor security risks, including SOC reports, security questionnaires, and data-sharing agreements.
 * Develop and maintain security policies, procedures, assessment reports, and governance documentation.
 * Support privacy, incident response, disaster recovery, and business continuity governance.
 * Assess security and compliance risks associated with emerging technologies, including AI.
 * Prepare executive-level security reports, risk assessments, compliance metrics, and remediation updates.
 * Collaborate with IT teams, business stakeholders, auditors, and leadership to strengthen security controls and regulatory compliance.