[Remote] IT Security Governance Analyst :: Richmond, VA (Remote)

Note: The job is a remote job and is open to candidates in USA. The hiring organization is confidential. The IT Security Governance Analyst maintains and enhances the organization’s security posture through risk assessments, compliance and governance activities, security documentation, and stakeholder guidance.

Responsibilities

• Conduct security risk assessments, Business Impact Analyses, data classifications, and privacy reviews
• Maintain risk registers, assessment records, corrective-action plans, and follow-up activities
• Apply and interpret security requirements and standards like NIST, CIS Controls, and more
• Collaborate with system and data owners to document security plans and maintain compliance evidence
• Review vendor security documentation and identify gaps and escalation needs
• Coordinate audit and oversight activities and manage corrective actions
• Develop and communicate security policies, standards, and governance processes
• Support the agency's security awareness and training program
• Assist with security planning for continuity, incident response, and disaster recovery
• Prepare executive and management reports on governance workload and compliance status
• Provide security guidance to project teams, IT, procurement, and vendors
• Participate in incident and post-incident governance activities

Skills

• Strong knowledge of cybersecurity governance, risk management, and compliance practices
• Familiarity with security frameworks and standards like NIST 800-53, HIPAA, PCI, and others
• Ability to analyze information, identify risks, and recommend actions
• Proficiency in developing and maintaining professional documentation
• Excellent communication skills with various stakeholders
• Ability to handle sensitive information with discretion and sound judgment
• 5 years in cybersecurity, information security, IT security governance, or risk management
• 3 years performing security risk assessments, compliance reviews, or GRC activities
• 4 years applying NIST security frameworks, including NIST SP 800-53
• 3 years conducting security control assessments and supporting IT audits
• 3 years maintaining risk registers and tracking corrective actions
• 5 years developing security documentation and executive summaries
• 3 years of strong written and verbal communication skills
• 3 years managing multiple security assessments and compliance activities

Benefits

• Remote work; candidates must be within a reasonable distance of Virginia for occasional on-site meetings.

Company Overview

Company H1B Sponsorship