IT Security Analyst

Job Title: IT Security Analyst 2
Work Type: Remote
Location: Richmond, VA 23225
Salary/Rate: $66.68/hr
Start Date: November 2, 2026
End Date: October 25, 2027
Industry Category: Information Technology / Cybersecurity
Employment Type: Contract

The Virginia Department of Corrections (DOC) is seeking an IT Security Analyst 2 to support its enterprise cybersecurity program. This role focuses on security governance, risk management, compliance, privacy, third-party risk, and audit readiness. The analyst will conduct security assessments, maintain risk documentation, support regulatory compliance, and work with technical teams, business owners, vendors, and auditors to identify risks and improve security practices.

The IT Security Governance Analyst supports the development, implementation, and improvement of DOC's cybersecurity governance and compliance activities. The position evaluates security risks across systems, applications, services, vendors, and technology initiatives; maintains governance records; reviews security controls and data-sharing agreements; and helps ensure compliance with Commonwealth of Virginia and applicable federal requirements. The analyst also supports security awareness training, emerging technology reviews, audit coordination, executive reporting, and corrective-action tracking.

• Conduct security risk assessments, Business Impact Analyses (BIAs), data classification reviews, privacy reviews, control assessments, and security feasibility reviews.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and remediation tracking in Archer GRC or other approved tools.
• Apply relevant security frameworks and requirements, including NIST guidance, VITA SEC
  530, CIS Controls, DoD STIGs, CJIS, VCIN, HIPAA, PCI, FERPA, and FTI.
• Work with system and data owners to document security plans, assign ownership, classify information, review controls, and maintain audit and authorization evidence.
• Review third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, and interconnection agreements.
• Evaluate data-sharing agreements, MOUs, and related documents for security, privacy, access control, least-privilege, data-handling, and incident-notification requirements.
• Coordinate audits and assessments, validate evidence, document findings, respond to inquiries, and track corrective actions through closure.
• Develop and maintain security policies, standards, procedures, guidelines, templates, and governance processes.
• Support security awareness and compliance training, including acknowledgements, tracking, reporting, and stakeholder education.
• Review emerging technology and artificial intelligence initiatives for security, privacy, compliance, data sensitivity, vendor assurances, and required approvals.
• Support governance activities related to incident response, disaster recovery, business continuity, audit logging, system hardening, access reviews, and vendor management.
• Prepare executive and management reports covering security risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide security guidance to project teams, IT operations, procurement, business units, and vendors; facilitate meetings and elevate unresolved risks when needed.
• Support post-incident governance reviews, control-gap identification, regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects as assigned.

• At least 5 years of experience in cybersecurity, information security, IT security governance, or risk management.
• At least 4 years of experience applying NIST…