IT Security Governance Analyst

Responsibilities: Conduct security risk assessments, privacy reviews, data classifications, control assessments, and security feasibility reviews for systems and initiatives Maintain risk registers, assessment records, corrective-action plans, evidence repositories, and remediation tracking in Archer GRC Apply organizational and regulatory requirements (NIST, CIS, CJIS/VCIN, HIPAA, PCI, FERPA, FTI, etc.) to governance activities Collaborate with system and data owners to document ownership, classify information, and maintain security plans and evidence for authorization and audit Review vendor/third-party security documentation (SOC reports, contracts, MOUs/MOAs/NDAs) to identify gaps and escalation needs Oversee interconnection and data-sharing governance through MOUs and related agreements Coordinate audits and oversight activities; collect evidence; manage corrective actions through closure Develop and maintain security policies, standards, and governance templates; propose improvements to reduce risk Support security awareness/training programs and targeted compliance training Evaluate emerging technology and AI initiatives for governance, privacy, and security considerations Assist with security planning for continuity, incident response, disaster recovery, and audit logging Prepare executive and management reporting on governance workload, risks, remediation, and priorities Provide clear security guidance to project teams, procurement, and vendors; facilitate meetings and escalate unresolved risk Participate in incident governance and post-incident review activities Perform other duties and special projects in support of IT Security Governance program

Key requirements: Knowledge of cybersecurity governance, risk management, compliance, privacy, and audit practices Knowledge of NIST 800-53, VITA SEC530, CIS Controls, CJIS/VCIN, HIPAA, PCI, FERPA, FTI, privacy and contractual obligations Ability to analyze information, identify risk, and recommend actionable controls Ability to document assessment reports, risk registers, security plans, and audit evidence Ability to manage multiple complex assignments and meet deadlines with diverse stakeholders Strong communication with executives, technical teams, vendors, auditors, and non-technical partners Ability to handle sensitive information with discretion and service orientation Working knowledge of security assessment methodologies, control validation, risk documentation, remediation tracking Ability to prepare clear written analyses and stakeholder communications Equivalent education/experience acceptable Effective communication with diverse stakeholders Strong organizational and prioritization skills Collaborative and professional demeanor Archer GRC or similar governance, risk, and compliance platform Security frameworks and standards (NIST 800-53, CIS Controls) Data classification and privacy impact assessment