Security Analyst - ASCENDING

Information Security Analyst

1-Year Contract (potential to extend)

Hybrid - Richmond VA (3 days onsite)

We are seeking an experienced Information Security Analyst to support governance, risk, compliance, privacy, and security initiatives across enterprise programs, systems, applications, and third-party engagements. This role will partner closely with business stakeholders, project teams, legal/privacy teams, and IT to ensure appropriate security controls, documentation, and risk-management practices are in place.

The ideal candidate brings strong experience with GRC processes, security frameworks, risk assessments, security documentation, and stakeholder communication.

Key Responsibilities

• Maintain and update security, risk, compliance, and related documentation within a Governance, Risk, and Compliance (GRC) platform.
• Partner with business and technology stakeholders to develop and maintain Information System Security Plans (SSPs).
• Facilitate information-gathering sessions to support SSPs, risk assessments, control evaluations, and other security work products.
• Participate in information security and privacy initiatives across business units, systems, projects, and supplier engagements.
• Represent the Information Security function on project and PMO initiatives to ensure security and privacy requirements are addressed throughout the project lifecycle.
• Collaborate with business teams to understand operational needs, identify security risks, recommend practical control options, and support compliance requirements.
• Assist in developing, maintaining, and improving information security policies, standards, processes, and procedures.
• Research industry best practices and applicable security guidance from reputable sources.
• Create and maintain controls documentation, including system diagrams, process maps, risk assessment templates, and security artifacts.
• Review vendor contracts, agreements, and supporting documentation to help ensure appropriate information security protections are included.
• Support security awareness, education, and other enterprise security initiatives as needed.

• Minimum of 3 years of experience in information security, with emphasis on governance, risk, and compliance (GRC).
• Strong understanding of information security principles, practices, controls, and risk-management methodologies.
• Experience working with security frameworks such as NIST, ISO 27001, or similar standards.
• Familiarity with security and privacy documentation, including SSPs, risk assessments, system diagrams, data flows, and process maps.
• Knowledge of IT infrastructure planning, implementation, and management principles.
• Experience supporting third-party/vendor risk reviews, contract reviews, or supplier security assessments.
• Excellent written, verbal, and stakeholder communication skills.
• Strong organizational skills, attention to detail, and ability to manage multiple priorities.
• Ability to work independently, meet deadlines, and adapt effectively in changing or ambiguous environments.

• Experience using a GRC platform.
• Experience supporting security and privacy programs in a regulated environment.
• Relevant certifications such as Security+, CISSP, CISM, CRISC, ISO 27001, or comparable credentials.
• Experience supporting security awareness and training programs.