All interviews are in-person with no exceptions.
The statements below describe the principal duties of the position and are not intended• Conduct and coordinate security risk assessments, Business Impact Analyses, data cla• Maintain risk registers, assessment records, corrective-action plans, exceptions, eviden• Apply and interpret Commonwealth and agency requirements, including VITA SEC530,• Partner with system owners and data owners to establish ownership, classify informatio• Review vendor and third-party security documentation, including SOC reports, security• Support interconnection and data-sharing governance by reviewing MOUs and related• Coordinate audit, assessment, and oversight activities; collect and validate evidence; re• Develop, maintain, and communicate security policies, standards, procedures, guidelin• Support the agency security awareness and training program, including targeted comp• Perform governance reviews for emerging technology and artificial intelligence initiative• Assist with security planning for continuity, incident response, disaster recovery, busine• Prepare accurate executive, management, and Commonwealth reporting on governanc• Provide clear security guidance to project teams, operational IT, procurement, business• Participate in incident and post-incident governance activities as assigned, including do• Perform other related duties and special projects in support of the IT Security GovernanKnowledge Skills and Abilities• Knowledge of cybersecurity governance, risk management, compliance, privacy, third-p• Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530• Ability to analyze technical and business information, identify risk, distinguish control ga• Ability to develop and maintain professional documentation, including assessment repo• Ability to manage multiple complex assignments, prioritize work under deadlines, and fo• Ability to communicate effectively with executives, technical teams, vendors, auditors, a• Ability to handle sensitive information with sound judgment, discretion, and a service-orDesired QualificationsThese qualifications would strengthen a candidate's application but would not be manda
Experience and Skills
Archer GRC: 3+ years of experience using Archer or comparable governance, risk, and cVITA SEC530: 2+ years of experience applying Commonwealth of Virginia information seThird-Party Risk Management: 3+ years reviewing vendor security documentation, SOCBusiness Impact Analysis: 3+ years conducting BIAs, data classification reviews, and seRegulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, oPrivacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and secIncident Response and Continuity Governance: 2+ years supporting incident response, dAI and Emerging Technology Governance: 1+ year assessing security, privacy, and comExecutive Reporting: 3+ years preparing security metrics, compliance reports, risk sum
