Archer GRC Analyst

Job ID: VA-814128 Remote/Local Archer GRC Analyst (In-person IV/12+) with cybersecurity, NIST, audit, VITA SEC530, SOC, BIAs, CIS/CJIS/VCIN/HIPAA/PCI DSS/FERPA/FTI, MOUs/MOAs/NDAs, BC/DR, AI compliance experience Location: Richmond, VA (DOC) Duration: 12 Months Interview: In Person Only This is a remote role. However, DOC has requested that candidates reside in Virginia or within a reasonable distance. They may have them report on site for meetings as needed. All interviews are in-person with no exceptions. Skills: - Experience in cybersecurity, information security, IT security governance, or risk management — Required: 5 Years experience performing security risk assessments, compliance reviews, or GRC activities. - 3 Years experience applying NIST security frameworks, including NIST SP 800-53 — Required - 4 Years experience conducting security control assessments and supporting IT audits — Required - 3 Years experience maintaining risk registers, documenting findings, and tracking corrective actions — Required - 3 Years Experience developing security documentation, policies, procedures, assessment reports, and executive summaries — Required - 3 Years Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership — Required - 3 Years Ability to manage multiple security assessments, compliance activities, and competing deadlines — Required Desired Qualifications: These qualifications would strengthen a candidate's application but would not be mandatory. - Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms. - VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements. - Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires. - Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments. - Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements. - Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations. - Incident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance. - AI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies. - Executive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings. The statements below describe the principal duties of the position and are not intended to be all-inclusive. -