Cyber Security Analyst

Direct End Client: Virginia Information Technology Agency (VITA) – Virginia Department of Corrections (DOC)

Job Title: Cybersecurity Governance, Risk & Compliance (GRC) Analyst

Duration: 12 Months

Location: 6900 Atmore Drive Richmond, VA 23225

Position Type: Contract

Interview Type: In-Person (No Exceptions)

Work Arrangement: Remote (Candidates must reside in Virginia or within a reasonable distance and may be required to report onsite for meetings)

Note: Candidate must be Local to Richmond, VA 23225 due to In-Person Interview

Position Summary:

• The Virginia Department of Corrections (DOC) is seeking an IT Security Governance Analyst to support and improve its enterprise cybersecurity program, focusing on security governance, risk management, compliance, privacy, and security assurance activities.
• The selected consultant will conduct security risk assessments, Business Impact Analyses (BIAs), data classification reviews, privacy assessments, security control assessments, and compliance reviews for enterprise systems, applications, services, and technology initiatives. The consultant will maintain risk registers, corrective-action plans, assessment documentation, and compliance evidence while ensuring alignment with Commonwealth of Virginia security requirements, NIST frameworks, and applicable regulatory standards.
• The role requires collaboration with system owners, business stakeholders, technical teams, vendors, auditors, and agency leadership to strengthen security controls, manage risks, support audits, and maintain compliance.

Responsibilities:

• Conduct and coordinate security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities using Archer GRC and other approved agency tools.
• Track remediation commitments, due dates, residual risks, and required executive decisions.
• Apply and interpret Commonwealth and agency security requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI, FERPA, FTI, privacy requirements, and contractual obligations.
• Collaborate with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence for authorization, audits, and ongoing compliance.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and interconnection documentation.
• Identify security gaps, compensating controls, contractual conditions, and issues requiring escalation.
• Review data-sharing agreements and interconnection documentation to ensure compliance with security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
• Coordinate audit, assessment, and oversight activities with internal audit, VITA, and other authorized reviewers.
• Collect and validate audit evidence, respond to inquiries, document findings, and manage corrective actions through closure.
• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes.
• Recommend practical improvements to strengthen compliance and reduce cybersecurity risks.
• Support security awareness and training programs, including compliance training, acknowledgements, tracking, reporting, and stakeholder education.
• Conduct governance reviews for emerging technologies and artificial intelligence initiatives, evaluating business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals.
• Support security planning for incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and related control areas.
• Prepare executive, management, and Commonwealth reports covering governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide security guidance to project teams, operational IT, procurement, business units, and vendors; facilitate meetings and escalate unresolved risks or noncompliance.
• Participate in incident and post-incident governance activities, including documentation reviews, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects supporting the IT Security Governance program.

Required Skills:

• 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
• 3 years of experience performing security risk assessments, compliance reviews, or Governance, Risk, and Compliance (GRC) activities.
• 4 years of experience applying NIST security frameworks, including NIST SP 800-53.
• 3 years of experience conducting security control assessments and supporting IT audits.
• 3 years of experience maintaining risk registers, documenting findings, and tracking corrective actions.
• 3 years of experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
• 3 years of experience demonstrating strong written and verbal communication skills with technical teams, business owners, auditors, and leadership
• 3 years of experience managing multiple security assessments, compliance activities, and competing deadlines.

V Group Inc. is an IT Services company which supplies IT staffing, project management, and delivery services in software, network, help desk and all IT areas. Our primary focus is the public sector including state and federal contracts. We have multiple awards/ contracts with the following states: NY, CA, FL, GA, IL, MD, MI, NC, OH, OR, PA, SC, TX, VA, and WA. If you are considering applying for a position with V Group, or in partnering with us on a position, please feel free to contact me with any questions you may have regarding our services and the advantages we can offer you as a consultant.

Please share my contact information with others working in Information Technology.

Website: www.vgroupinc.com

LinkedIn: www.linkedin.com/company/v-group/

Facebook: www.facebook.com/VGroupIT

Twitter: www.twitter.com/vgroupinc