IT Security Analyst

Ampcus Inc. is a certified global provider of a broad range of Technology and Business consulting services. We are in search of a highly motivated candidate to join our talented Team.

The IT Security Governance Analyst supports the enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities.

• Remote position.
• Candidates should reside in Virginia or within a reasonable distance to report onsite for meetings as needed.
• All interviews are in person, with no exceptions.

• Conduct and coordinate security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
• Apply and interpret applicable security requirements, including VITA SEC
  530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.
• Partner with system and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence for authorization, audits, and ongoing compliance.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and interconnection documentation. Identify gaps, conditions, compensating controls, and escalation requirements.
• Review interconnection and data-sharing agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
• Coordinate audits, assessments, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit teams and authorized reviewers.
• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend improvements to strengthen compliance and reduce risk.
• Support security awareness and training programs, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
• Conduct governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals. Document outcomes and handoffs.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
• Prepare executive, management, and Commonwealth reports covering governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and elevate unresolved risks or noncompliance through established channels.
• Participate in incident and post-incident governance activities, including documentation reviews, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects in support of the IT Security Governance program.

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards, including NIST SP 800-53, VITA SEC
  530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risks, distinguish control gaps from acceptable residual risks, and recommend clear, defensible actions.
• Ability to develop and maintain professional documentation, including assessment reports, risk registers,…