Security & Safety,Marketing|Communications|Director of Communications,Marketing,Administration,Administration|Data Entry,Marketing|Communications Jobs

IT Security Analyst 2
 
Primary Location: Richmond, VA
 
 
 
 
V-Soft Consulting is currently hiring for a IT Security Analyst 2 for our premier client in Richmond, VA.
 
 
 
Education and Experience:
 

• 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
• Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
• Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.

 
 
Knowledge and Skills:
 

• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.

 
 
 
WHAT YOU’LL DO:
Job Responsibilities:
 

• Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas

 
Interested?
 
Qualified candidates should send their resumes to (url removed)
 
 
 
V-Soft Consulting Group is recognized among the top 100 fastest growing staffing companies in North America, V-Soft Consulting Group is headquartered in Louisville, KY with strategic locations in India, Canada and the U.S. V-Soft is known as an agile, innovative technology services company holding several awards and distinctions and has a wide variety of partnerships across diverse technology stacks.
 
As a valued V-Soft Consultant, you’re eligible for full benefits (Medical, Dental, Vision), a 401(k) plan, competitive compensation and more. V-Soft is partnered with numerous Fortune 500 companies, exceptionally positioned to advance your career growth.
 
V-Soft Consulting provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.
 
 
For more information or to view all our open jobs, please visit (url removed) or call (phone number removed).

(phone number removed) DOC Security Analyst
Contract role

This is a remote role. However, DOC has requested that candidates reside in Virginia or within a reasonable distance in the event they need to report on site. They may have them report on site for meetings as needed.

All interviews are in-person with no exceptions.
The statements below describe the principal duties of the position and are not intended to be all-inclusive.


• Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
• Apply and interpret Commonwealth and agency requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.
• Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.
• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.
• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
• Coordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit, VITA, and other authorized reviewers.
• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.
• Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
• Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.
• Prepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
• Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risk or noncompliance through established channels.
• Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
• Perform other related duties and special projects in support of the IT Security Governance program.

Knowledge Skills and Abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
• Ability to develop and maintain professional DOCumentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.
• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Desired Qualifications

These qualifications would strengthen a candidate's application but would not be
mandatory.

- Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and
compliance platforms.

- VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.

- Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC
reports, and security questionnaires.

- Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and
security feasibility assessments.

- Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or
FTI requirements.

- Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and
security/privacy obligations.

- Incident Response and Continuity Governance: 2+ years supporting incident response,
disaster recovery, or business continuity compliance.

- AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.

- Executive Reporting: 3+ years preparing security metrics, compliance reports, risk
summaries, and management briefings.

Skills Matrix: Skill Required / Desired Min Yrs Exp Required Actual Yrs Exp Year Last Used experience in cybersecurity, information security, IT security governance, or risk management. Required 5     experience performing security risk assessments, compliance reviews, or GRC activities. Required 3     experience applying NIST security frameworks, including NIST SP 800-53. Required 4     experience conducting security control assessments and supporting IT audits. Required 3     experience maintaining risk registers, DOCumenting findings, and tracking corrective actions. Required 3     6.Experience developing security DOCumentation, policies, procedures, assessment reports, and executive summaries. Required 5     Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership. Required 3     Ability to manage multiple security assessments, compliance activities, and competing deadlines. Required 3

DOC - IT Security Analyst 2 ((phone number removed))

Title/Role: DOC - IT Security Analyst 2

Start Date: 11/02/2026

End Date: 10/25/2027

Worksite Address: 6900 Atmore Drive Richmond Virginia 23225

Agency Interview Type: In Person Only

Work Arrangement: Remote

Engagement Type: Contract

Short Description:

The IT Security Governance Analyst supports the Virginia Department of Corrections enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities.

Complete Description:

This is a remote role. However, DOC has requested that candidates reside in Virginia or within a reasonable distance in the event they need to report on site. They may have them report on site for meetings as needed.

All interviews are in-person with no exceptions.

The statements below describe the principal duties of the position and are not intended to be all-inclusive.

• Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.

• Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.

• Apply and interpret Commonwealth and agency requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.

• Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.

• Review vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.

• Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.

• Coordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit, VITA, and other authorized reviewers.

• Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.

• Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.

• Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.

• Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.

• Prepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.

• Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risk or noncompliance through established channels.

• Participate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.

• Perform other related duties and special projects in support of the IT Security Governance program.

Knowledge Skills and Abilities

• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.

• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.

• Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.

• Ability to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.

• Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.

• Ability to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.

• Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.

Desired Qualifications

These qualifications would strengthen a candidate's application but would not be mandatory.

Experience and Skills

1. Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.
2. VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.
3. Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.
4. Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.
5. Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.
6. Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.
7. Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.
8. AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.
9. Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.

Skill Required / Desired Amount of Experience

experience in cybersecurity, information security, IT security governance, or risk management. Required 5 Years

experience performing security risk assessments, compliance reviews, or GRC activities. Required 3 Years

experience applying NIST security frameworks, including NIST SP 800-53. Required 4 Years

experience conducting security control assessments and supporting IT audits. Required 3 Years

experience maintaining risk registers, documenting findings, and tracking corrective actions. Required 3 Years

6. Experience developing security documentation, policies, procedures, assessment reports, and executive summaries. Required 5 Years

Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership. Required 3 Years

Ability to manage multiple security assessments, compliance activities, and competing deadlines. Required 3 Years