CI
IT Security Analyst
Crescens Inc.
- 🇨🇦 Canada | 🇺🇸 United States
- Remote
- Staff / Principal
- 13 hours ago
- Archer
- NIST
- CIS Controls
- STIGs
- CJIS
- HIPAA
- FERPA
- AI
- Incident Response
- Disaster Recovery
- Risk Management
- Regulatory Compliance
- PCI DSS
13 hours ago
Location: Richmond, VA (Mostly Remote)
Duration: 12+ Month
This is a remote role. However, DOC has requested that candidates reside in Virginia or within a reasonable distance in the event they need to report on site. They may have them report on site for meetings as needed.
All interviews are in-person with no exceptions.
Job Descriptions:
- The statements below describe the principal duties of the position and are not intended to be all-inclusive.
- Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
- Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
- Apply and interpret Commonwealth and agency requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.
- Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.
- Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs,
- MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.
- Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access control, incident-notification, and annual review requirements.
- Coordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit, VITA, and other authorized reviewers.
- Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.
- Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
- Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
- Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
- Prepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
- Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risk or noncompliance through established channels.
- Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
- Perform other related duties and special projects in support of the IT Security Governance program.
- Knowledge Skills and Abilities
- Knowledge of Cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
- Knowledge of security frameworks and standards such as NIST 800-53, VITA
- SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
- Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
- Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
- Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
- Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
- Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.
- These qualifications would strengthen a candidate's application but would not be mandatory.
- Experience and Skills
- Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
- VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
- Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
- Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
- Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
- Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.
- Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
- AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
- Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.
- Experience in Cybersecurity, information security, IT security governance, or risk management.
- Experience performing security risk assessments, compliance reviews, or GRC activities.
- Experience applying NIST security frameworks, including NIST SP 800-53.
- Experience conducting security control assessments and supporting IT audits.
- Experience maintaining risk registers, documenting findings, and tracking corrective actions.
- Experience developing security documentation, policies, procedures, assessment reports, and executive summaries.
- Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership
- Ability to manage multiple security assessments, compliance activities, and competing deadlines.
IT Security Analyst · Crescens Inc.