IT Security Analyst 2
Title/Role: DOC - IT Security Analyst 2 (814128) Start Date: 11/02/2026 End Date: 10/25/2027 No New Submittals After: 10/28/2026 Worksite address: 6900 Atmore Drive, Richmond, Virignia 23225 Max Submittals by Vendor: 2 CAI Contract Manager: Lynch, Kevin Interview Type: In-person only Work Arrangement: Remote Bill rate: 66.68/hr The IT Security Governance Analyst supports the Virginia Department of Corrections enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities. Complete Description: This is a remote role. However, DOC has requested that candidates reside in Virginia or within a reasonable distance. They may have them report on site for meetings as needed. All interviews are in-person with no exceptions. The statements below describe the principal duties of the position and are not intended to be all-inclusive. - Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives. - Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. - Track remediation commitments, due dates, residual risk, and required executive decisions. - Apply and interpret Commonwealth and agency requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations. - Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance. - Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. - Identify conditions, gaps, compensating controls, and escalation needs. - Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements. - Coordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective