Security & Compliance Analyst

Starting Salary Range: $65,000 - $100,000

• Coordinate with federal agencies, SCC internal teams, vendors, and 3rd parties to perform privacy and security assessments, audits, and other security and privacy compliances activities
• Conduct complex audits of HBE partners and vendors to evaluate compliance with privacy and security requirements
• Lead and participate in internal assessments to evaluate compliance with information security and privacy policies, procedures, regulations, and agreements
• Monitor regulatory changes, evaluate impacts, and prepare reports and recommendations for compliance on security and privacy policies for HBE senior leadership
• Review and update security and privacy control documentation to ensure it is accurate, up to date, and adheres to legal and regulatory requirements
• Develop and present compliance findings from audits and assessments to HBE senior leadership and prepare remediation reports
• Develop, update, and support implementation of data security and privacy protection policies and procedures
• Coordinate with vendors and monitor complex security and privacy incidents
• Contribute to continuous improvement efforts
• Perform related work as required

• Two (2) or more years of professional experience in information security; governance, risks and compliance (GRC); and/or audit and compliance
• Experience with risk assessments, risk and vulnerability management, and incident response activities
• Experience reviewing privacy and security controls, performing or coordinating security audits or assessments, and developing policy or procedure documentation
• Familiarity with NIST 800-53 or other related security frameworks and/or with AWS or other cloud environments is required
• Bachelor’s degree in information security, information systems, computer science, or a related field is preferred, but not required with six (6) or more years of related experience
• Ability to research and remain up to date on regulatory compliance
• Ability to work independently and as part of a team
• Strong interpersonal skills and initiative
• Ability to establish and maintain effective working relationships with SCC staff, industry personnel, auditors, and HBE partners and vendors
• Excellent verbal and written communication skills
• Strong problem-solving, analytical, and organizational skills
• Ability to manage multiple priorities in a fast-paced environment
• Experience with information security regarding the health insurance industry and/or the Affordable Care Act is a plus
• CISA, CRISC, CGEIT, GRCP, CISM, or other related certifications are considered a plus

Located in downtown Richmond, the State Corporation Commission (SCC) is an independent state agency with regulatory authority over public utilities, insurance, state-chartered financial institutions, investment securities, retail franchising, and utility and railroad safety, as well as serving as the state’s central filing office for businesses. The SCC is also charged with administering Virginia’s health insurance marketplace. The SCC’s structure is unique.

No other state has a single agency with such a broad array of regulatory responsibility.

The SCC offers our employees rewarding, impactful work; flexible telework options and work-life balance; and professional development opportunities. The SCC fosters a high-performing workforce with a commitment to diversity and inclusion, collaboration, and alignment with the SCC’s mission and strategic goals. Core benefits provided to SCC employees include competitive health and life insurance programs, pre-tax spending accounts, leave programs, and paid holidays.

Employees participate in a state retirement plan with options for tax-deferred retirement…