IT Cybersecurity Analyst 3 - Richmond, VA

Role: IT Cybersecurity Analyst 3

Location: Richmond, VA

Duration: 6+ Months

This risk management role is to communicate risk policies and processes for the Virginia Department of Health (VDH) Information Security Program. 

They provide hands-on development of risk models, risk assessments, and security documentation.

Duties and responsibilities 

• Designing and implementing an overall risk management process for the organization.

• Performing a risk assessment for each IT application: Analyzing current risks and identifying potential risks that are affecting the organization.

• Performing a risk evaluation: Evaluating the organization's previous handling of risks, comparing potential risks and associated costs and legal requirements.

• Establishing the level of risk the organization are willing to accept.

• Risk reporting tailored to the relevant audience. (Educating the leadership team about the most significant risks to the business; ensuring business heads understand the risks that might affect their departments; ensuring individuals understand their own accountability for individual risks).

• Explaining the external risk posed by corporate governance to stakeholders.

• Conducting policy and compliance audits, which will include liaising with internal and external auditors.

• Maintaining records of security documentation and artifacts for all IT applications.

• Participating in new project initiation, enhancements, and other assigned projects.

• Perform accreditation and certification of IT applications.

• Perform vendor management and security assessments. 

• Review Interoperability agreements, data sharing agreements, and/or Memorandum of Understandings for new or existing applications.

• Reviewing any new major contracts or internal business proposals.

• Building risk awareness amongst staff by providing support and training within the organization.

• Provide quarterly updates on risk assessments and audit recommendations/corrective action plans.

Skill Matrix:

Hands on experience with risk assessments, risk profiles, risk remediation, security controls, and security documents. - Required - 5 Years

5 years of compliance, risk management, data privacy, or related experience. - Required - 5 Years

Fundamental knowledge of risk mitigation methodologies, processes, and procedures of related specialty. - Required - 5 Years

General understanding of information technology concepts (applications, data storage, data contingency, etc.). - Required - 5 Years

Demonstrated ability to work professionally with personnel at all levels of the organization and handle sensitive information with the highest degree - Required - 5 Years