IT Security Analyst 2

Ampcus Inc. is a certified global provider of a broad range of Technology and Business consulting services. We are in search of a highly motivated candidate to join our talented Team.

Job Title: IT Security Analyst 2

Location(s): Richmond, VA
(Remote)

Job Summary
The IT Security Governance Analyst supports the enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities.

Work Arrangement

• Remote position.
• Candidates should reside in Virginia or within a reasonable distance to report onsite for meetings as needed.
• All interviews are in person, with no exceptions.

Responsibilities

• Conduct and coordinate security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
• Apply and interpret applicable security requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.
• Partner with system and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence for authorization, audits, and ongoing compliance.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and interconnection documentation. Identify gaps, conditions, compensating controls, and escalation requirements.
• Review interconnection and data-sharing agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
• Coordinate audits, assessments, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit teams and authorized reviewers.
• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend improvements to strengthen compliance and reduce risk.
• Support security awareness and training programs, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
• Conduct governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals. Document outcomes and handoffs.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
• Prepare executive, management, and Commonwealth reports covering governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risks or noncompliance through established channels.
• Participate in incident and post-incident governance activities, including documentation reviews, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects in support of the IT Security Governance program.

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards, including NIST SP 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risks, distinguish control gaps from acceptable residual risks, and recommend clear, defensible actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on activities involving multiple stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

• The following qualifications are preferred but not mandatory.
• Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
• VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
• Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
• Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
• Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
• Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security and privacy obligations.
• Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
• AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
• Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

Skills: