IT Security Analyst 2

Role Overview

Ampcus Inc. is recruiting a confidential client to join their enterprise cybersecurity program as an IT Security Governance Analyst. This role focuses on administering and improving governance, risk, compliance (GRC), privacy, and security assurance activities.

Key Responsibilities:

• Conduct and coordinate comprehensive security risk assessments, Business Impact Analyses (BIAs), data classifications, privacy reviews, control assessments, and feasibility reviews for new systems and technology initiatives.
• Maintain detailed records including risk registers, corrective-action plans, exceptions, and evidence repositories using Archer GRC. Track remediation commitments and residual risks.
• Apply security requirements such as VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS/VCIN, HIPAA, PCI, FERPA, FTI, and contractual obligations.
• Partner with system/data owners to classify information, document controls, complete reviews, and maintain audit evidence.
• Review vendor documentation (SOC reports, questionnaires, contracts) to identify gaps and compensating controls.
• Analyze interconnection agreements for security, privacy, access control, and incident notification requirements.
• Coordinate audits, collect/validate evidence, document findings, and manage corrective actions with internal audit teams.
• Develop policies, standards, procedures, guidelines, and governance processes; recommend improvements to reduce risk.
• Support awareness training programs for technical staff and stakeholders.
• Conduct governance reviews for emerging technologies and AI initiatives, including privacy/security assessments and vendor approvals.
• Assist with security planning for continuity, incident response, disaster recovery, access reviews, and hardening.
• Prepare executive reports covering workload, inventory, risks, findings, remediation progress, metrics, and priorities.
• Provide guidance to project teams, IT operations, procurement, business units, and vendors; communicate requirements professionally.
• Participate in incident governance activities including post-incident reviews and corrective-action tracking.

Must Have Qualifications:

- Knowledge of cybersecurity GRC, privacy, third-party risk, and audit practices.
- Familiarity with NIST SP 800-53, VITA SEC530, CIS Controls, CJIS/VCIN, HIPAA, PCI, FERPA, FTI requirements.
- Ability to analyze technical/business info, identify risks/control gaps, and recommend defensible actions.
- Experience developing professional documentation (reports, risk registers, security plans).
- Strong multi-tasking skills with multiple stakeholders under deadlines.
- Discretion in handling sensitive information.
- Background in cybersecurity governance, IT audits, control assessments, and policy development.

Preferred Qualifications:

• 3+ years using Archer GRC or comparable platforms.
• 2+ years applying VITA SEC530 (Commonwealth of Virginia requirements).
• 3+ years in Third-Party Risk Management and vendor documentation reviews.
• 3+ years conducting BIAs, data classification, and feasibility assessments.
• 3+ years with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI compliance.
• 2+ years reviewing privacy obligations and data-sharing agreements (MOUs/NDAs).
• 2+ years supporting incident response, disaster recovery, and business continuity governance.
• 1+ year assessing emerging technology/AI security risks.
• 3+ years preparing executive risk/compliance metrics reports.