Cybersecurity Risk and Compliance Analyst

Job Title: Cybersecurity Risk and Compliance Analyst Location: Richmond, VA, (Remote)-They may have them report on site for meetings as needed. Position Type: Contract Interview Mode: In-person interview only.

Knowledge Skills And Abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.
  
  

Desired Qualifications

These qualifications would strengthen a candidate's application but would not be mandatory.

Experience And Skills

• Archer GRC: 3 years of experience using Archer or comparable governance, risk, and compliance platforms.
• VITA SEC530: 2 years of experience applying Commonwealth of Virginia information security requirements.
• Third-Party Risk Management: 3 years reviewing vendor security documentation, SOC reports, and security questionnaires.
• Business Impact Analysis: 3 years conducting BIAs, data classification reviews, and security feasibility assessments.
• Regulatory Compliance: 3 years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
• Privacy and Data Sharing: 2 years reviewing data-sharing agreements, MOUs, and security/privacy obligations.
• Incident Response and Continuity Governance: 2 years supporting incident response, disaster recovery, or business continuity compliance.
• AI and Emerging Technology Governance: 1 year assessing security, privacy, and compliance risks associated with emerging technologies.
• Executive Reporting: 3 years preparing security metrics, compliance reports, risk summaries, and management briefings.
  
  

Required/Desired Skills Skill Required /Desired Amount Actual Years of Experience experience in cybersecurity, information security, IT security governance, or risk management. Required 5 experience performing security risk assessments, compliance reviews, or GRC activities. Required 3 experience applying NIST security frameworks, including NIST SP 800-53. Required 4 experience conducting security control assessments and supporting IT audits. Required 3 experience maintaining risk registers, documenting findings, and tracking corrective actions. Required 3 6. Experience developing security documentation, policies, procedures, assessment reports, and executive summaries. Required 5 Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership. Required 3 Ability to manage multiple security assessments, compliance activities, and competing deadlines. Required 3