All interviews are in-person with no exceptions.
The statements below describe the principal duties of the position and are not intended
Conduct and coordinate security risk assessments, Business Impact Analyses, data cla
Maintain risk registers, assessment records, corrective-action plans, exceptions, eviden
Apply and interpret Commonwealth and agency requirements, including VITA SEC530,
Partner with system owners and data owners to establish ownership, classify informatio
Review vendor and third-party security documentation, including SOC reports, security
Support interconnection and data-sharing governance by reviewing MOUs and related
Coordinate audit, assessment, and oversight activities; collect and validate evidence; re
Develop, maintain, and communicate security policies, standards, procedures, guidelin
Support the agency security awareness and training program, including targeted comp
Perform governance reviews for emerging technology and artificial intelligence initiative
Assist with security planning for continuity, incident response, disaster recovery, busine
Prepare accurate executive, management, and Commonwealth reporting on governanc
Provide clear security guidance to project teams, operational IT, procurement, business
Participate in incident and post-incident governance activities as assigned, including do
Perform other related duties and special projects in support of the IT Security GovernanKnowledge Skills and Abilities
Knowledge of cybersecurity governance, risk management, compliance, privacy, third-p
Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530
Ability to analyze technical and business information, identify risk, distinguish control ga
Ability to develop and maintain professional documentation, including assessment repo
Ability to manage multiple complex assignments, prioritize work under deadlines, and fo
Ability to communicate effectively with executives, technical teams, vendors, auditors, a
Ability to handle sensitive information with sound judgment, discretion, and a service-orDesired QualificationsThese qualifications would strengthen a candidate's application but would not be manda
Experience and Skills
Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and c
VITA SEC530: 2+ years of experience applying Commonwealth of Virginia information se
Third-Party Risk Management: 3+ years reviewing vendor security documentation, SOC
Business Impact Analysis: 3+ years conducting BIAs, data classification reviews, and se
Regulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, o
Privacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and sec
Incident Response and Continuity Governance: 2+ years supporting incident response, d
AI and Emerging Technology Governance: 1+ year assessing security, privacy, and com
Executive Reporting: 3+ years preparing security metrics, compliance reports, risk sum