Benefits:

Title: Cybersecurity Risk Analyst

Location: Richmond, VA, (Remote)-Report on site for meetings as needed.

Position Type: Contract

Interview Mode: In-person Only

Knowledge Skills and Abilities

Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Desired Qualifications

These qualifications would strengthen a candidate's application but would not be mandatory.

Experience and Skills

Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.
Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

3. Recommended Screening Priorities

Required/Desired Skills

Flexible work from home options available.