Cybersecurity Risk and Compliance Analyst

Benefits:

401(k) matching
Dental insurance
Health insurance
Vision insurance
Job Title:

Cybersecurity Risk and Compliance Analyst
Location:

Richmond, VA, (Remote)-They may have them report on site for meetings as needed.
Position Type:

Contract
Interview Mode:

In-person interview only.

Knowledge Skills and Abilities

Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.
Desired Qualifications
These qualifications would strengthen a candidates application but would not be mandatory.
Experience and Skills
Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.
Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.
Required/Desired Skills
Skill

|

Required /Desired

|

Amount

|

Actual Years of Experience
experience in cybersecurity, information security, IT security governance, or risk management. | Required | 5 |
experience performing security risk assessments, compliance reviews, or GRC activities. | Required | 3 |
experience applying NIST security frameworks, including NIST SP 800-53. | Required | 4 |
experience conducting security control assessments and supporting IT audits. | Required | 3 |
experience maintaining risk registers, documenting findings, and tracking corrective actions. | Required | 3 |
6. Experience developing security documentation, policies, procedures, assessment reports, and executive summaries. | Required | 5 |
Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership. | Required | 3 |
Ability to manage multiple security assessments, compliance activities, and competing deadlines. | Required | 3 |
Flexible work from home options available.