The Role
Supports enterprise information security governance, risk, compliance, privacy, and third-party security initiatives. Maintains GRC documentation, SSPs, risk assessments, controls, policies, process maps, and security artifacts. Partners with business, technology, legal, privacy, project, and vendor stakeholders to identify risks, recommend controls, review contracts, and address security requirements throughout project lifecycles. Also researches security guidance and supports awareness and training programs.
Summary Generated by Built In
Information Security Analyst
1-Year Contract (potential to extend)
Hybrid – Richmond VA (3 days onsite)
We are seeking an experienced Information Security Analyst to support governance, risk, compliance, privacy, and security initiatives across enterprise programs, systems, applications, and third-party engagements. This role will partner closely with business stakeholders, project teams, legal/privacy teams, and IT to ensure appropriate security controls, documentation, and risk-management practices are in place.
The ideal candidate brings strong experience with GRC processes, security frameworks, risk assessments, security documentation, and stakeholder communication.
Key Responsibilities
1-Year Contract (potential to extend)
Hybrid – Richmond VA (3 days onsite)
We are seeking an experienced Information Security Analyst to support governance, risk, compliance, privacy, and security initiatives across enterprise programs, systems, applications, and third-party engagements. This role will partner closely with business stakeholders, project teams, legal/privacy teams, and IT to ensure appropriate security controls, documentation, and risk-management practices are in place.
The ideal candidate brings strong experience with GRC processes, security frameworks, risk assessments, security documentation, and stakeholder communication.
Key Responsibilities
- Maintain and update security, risk, compliance, and related documentation within a Governance, Risk, and Compliance (GRC) platform.
- Partner with business and technology stakeholders to develop and maintain Information System Security Plans (SSPs).
- Facilitate information-gathering sessions to support SSPs, risk assessments, control evaluations, and other security work products.
- Participate in information security and privacy initiatives across business units, systems, projects, and supplier engagements.
- Represent the Information Security function on project and PMO initiatives to ensure security and privacy requirements are addressed throughout the project lifecycle.
- Collaborate with business teams to understand operational needs, identify security risks, recommend practical control options, and support compliance requirements.
- Assist in developing, maintaining, and improving information security policies, standards, processes, and procedures.
- Research industry best practices and applicable security guidance from reputable sources.
- Create and maintain controls documentation, including system diagrams, process maps, risk assessment templates, and security artifacts.
- Review vendor contracts, agreements, and supporting documentation to help ensure appropriate information security protections are included.
- Support security awareness, education, and other enterprise security initiatives as needed.
- Minimum of 3 years of experience in information security, with emphasis on governance, risk, and compliance (GRC).
- Strong understanding of information security principles, practices, controls, and risk-management methodologies.
- Experience working with security frameworks such as NIST, ISO 27001, or similar standards.
- Familiarity with security and privacy documentation, including SSPs, risk assessments, system diagrams, data flows, and process maps.
- Knowledge of IT infrastructure planning, implementation, and management principles.
- Experience supporting third-party/vendor risk reviews, contract reviews, or supplier security assessments.
- Excellent written, verbal, and stakeholder communication skills.
- Strong organizational skills, attention to detail, and ability to manage multiple priorities.
- Ability to work independently, meet deadlines, and adapt effectively in changing or ambiguous environments.
- Experience using a GRC platform.
- Experience supporting security and privacy programs in a regulated environment.
- Relevant certifications such as Security+, CISSP, CISM, CRISC, ISO 27001, or comparable credentials.
- Experience supporting security awareness and training programs.
Skills Required
- At least 3 years of information security experience, emphasizing governance, risk, and compliance
- Strong understanding of information security principles, controls, practices, and risk management methodologies
- Experience with security frameworks such as NIST or ISO 27001
- Familiarity with SSPs, risk assessments, system diagrams, data flows, and process maps
- Knowledge of IT infrastructure planning, implementation, and management principles
- Experience supporting third-party or vendor risk reviews, contract reviews, or supplier security assessments
- Excellent written, verbal, and stakeholder communication skills
- Strong organization, attention to detail, and ability to manage multiple priorities
- Ability to work independently, meet deadlines, and adapt to changing or ambiguous environments
- Experience using a GRC platform
- Experience supporting security and privacy programs in a regulated environment
- Relevant certification such as Security+, CISSP, CISM, CRISC, or ISO 27001
- Experience supporting security awareness and training programs
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
The ASCENDING team commits to delivering scalable and high-available cloud solutions to clients. We use advanced technology to measure the effectiveness of your current IT infrastructure. Then we help our clients migrate to the cloud and modernize their IT infrastructure.
