Security Analyst

1-Year Contract (potential to extend)

Hybrid – Richmond VA (3 days onsite)

We are seeking an experienced Information Security Analyst to support governance, risk, compliance, privacy, and security initiatives across enterprise programs, systems, applications, and third-party engagements. This role will partner closely with business stakeholders, project teams, legal/privacy teams, and IT to ensure appropriate security controls, documentation, and risk-management practices are in place. The ideal candidate brings strong experience with GRC processes, security frameworks, risk assessments, security documentation, and stakeholder communication.

• Maintain and update security, risk, compliance, and related documentation within a Governance, Risk, and Compliance (GRC) platform.
• Partner with business and technology stakeholders to develop and maintain Information System Security Plans (SSPs).
• Facilitate information-gathering sessions to support SSPs, risk assessments, control evaluations, and other security work products.
• Participate in information security and privacy initiatives across business units, systems, projects, and supplier engagements.
• Represent the Information Security function on project and PMO initiatives to ensure security and privacy requirements are addressed throughout the project lifecycle.
• Collaborate with business teams to understand operational needs, identify security risks, recommend practical control options, and support compliance requirements.
• Assist in developing, maintaining, and improving information security policies, standards, processes, and procedures.
• Research industry best practices and applicable security guidance from reputable sources.
• Create and maintain controls documentation, including system diagrams, process maps, risk assessment templates, and security artifacts.
• Review vendor contracts, agreements, and supporting documentation to help ensure appropriate information security protections are included.
• Support security awareness, education, and other enterprise security initiatives as needed.

• Minimum of 3 years of experience in information security, with emphasis on governance, risk, and compliance (GRC).
• Strong understanding of information security principles, practices, controls, and risk-management methodologies.
• Experience working with security frameworks such as NIST, ISO 27001, or similar standards.
• Familiarity with security and privacy documentation, including SSPs, risk assessments, system diagrams, data flows, and process maps.
• Knowledge of IT infrastructure planning, implementation, and management principles.
• Experience supporting third-party/vendor risk reviews, contract reviews, or supplier security assessments.
• Excellent written, verbal, and stakeholder communication skills.
• Strong organizational skills, attention to detail, and ability to manage multiple priorities.
• Ability to work independently, meet deadlines, and adapt effectively in changing or ambiguous environments.

• Experience using a GRC platform.
• Experience supporting security and privacy programs in a regulated environment.
• Relevant certifications such as Security+, CISSP, CISM, CRISC, ISO 27001, or comparable credentials.
• Experience supporting security awareness and training programs.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or protected veteran status.