{"id":3096396,"url":"https://alion.io/job/novalink-solutions-llc-it-security-analyst-2","title":"IT Security Analyst 2","company":{"id":4449854,"name":"NOVALINK SOLUTIONS LLC","domain":"novalink-solutions.com","url":"https://alion.io/company/novalink-solutions-llc","size_band":null,"is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":"Zoho Recruit","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"contractor","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Richmond, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":78000,"max_usd":149000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":502},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"HIPAA","optional":false},{"name":"Least Privilege","optional":false},{"name":"NIST 800-53","optional":false},{"name":"PCI DSS","optional":false}],"status":"closed","first_seen_at":"2026-10-22T16:19:12Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-10-28T13:51:28Z","board_verified":false,"closed_at":"2026-10-28T13:51:28Z","days_open":5,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":5},"description":"The statements below describe the principal duties of the position and are not intended to be all-inclusive.\nConduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.\nMaintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.\nApply and interpret Commonwealth and agency requirements, including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI, privacy, and contractual obligations.\nPartner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.\nReview vendor and third-party security documentation, including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.\nSupport interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.\nCoordinate audit, assessment, and oversight activities; collect and validate evidence; respond to inquiries; document findings; and manage corrective actions through closure with internal audit, VITA, and other authorized reviewers.\nDevelop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.\nSupport the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.\nPerform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.\nAssist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration and hardening, access reviews, vendor management, and other control areas.\nPrepare accurate executive, management, and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.\nProvide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risk or noncompliance through established channels.\nParticipate in incident and post-incident governance activities as assigned, including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.\nPerform other related duties and special projects in support of the IT Security Governance program.\nKnowledge Skills and Abilities\nKnowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.\nKnowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.\nAbility to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.\nAbility to develop and maintain professional documentation, including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.\nAbility to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.\nAbility to communicate effectively with executives, technical teams, vendors, auditors, and nontechnical business partners.\nAbility to handle sensitive information with sound judgment, discretion, and a service-oriented approach.\nDesired Qualifications\nThese qualifications would strengthen a candidate's application but would not be mandatory.\nExperience and Skills\nArcher GRC: 3+ years of experience using Archer or comparable governance, risk, and compliance platforms.\nVITA SEC530: 2+ years of experience applying Commonwealth of Virginia information security requirements.\nThird-Party Risk Management: 3+ years reviewing vendor security documentation, SOC reports, and security questionnaires.\nBusiness Impact Analysis: 3+ years conducting BIAs, data classification reviews, and security feasibility assessments.\nRegulatory Compliance: 3+ years working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements.\nPrivacy and Data Sharing: 2+ years reviewing data-sharing agreements, MOUs, and security/privacy obligations.\nIncident Response and Continuity Governance: 2+ years supporting incident response, disaster recovery, or business continuity compliance.\nAI and Emerging Technology Governance: 1+ year assessing security, privacy, and compliance risks associated with emerging technologies.\nExecutive Reporting: 3+ years preparing security metrics, compliance reports, risk summaries, and management briefings.\n\nRequirements\n\nSkill\nRequired / Desired\nAmount\nof Experience\nexperience in cybersecurity, information security, IT security governance, or risk management.\nRequired\n5\nYears\n\nexperience performing security risk assessments, compliance reviews, or GRC activities.\nRequired\n3\nYears\n\nexperience applying NIST security frameworks, including NIST SP 800-53.\nRequired\n4\nYears\n\nexperience conducting security control assessments and supporting IT audits.\nRequired\n3\nYears\n\nexperience maintaining risk registers, documenting findings, and tracking corrective actions.\nRequired\n3\nYears\n\nExperience developing security documentation, policies, procedures, assessment reports, and executive summaries.\nRequired\n3","description_format":"text","description_chars":6416,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Compliance"],"lifecycle":[{"event":"open","at":"2026-10-22T16:19:12Z"},{"event":"close","at":"2026-10-28T13:51:28Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 13 · green card filings: 6","filings_12m":13,"filings_prev_12m":22,"green_card_filings_12m":6,"median_offered_wage_usd":124605,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":null,"pay":null,"html_url":"https://alion.io/job/novalink-solutions-llc-it-security-analyst-2","json_url":"https://alion.io/job/novalink-solutions-llc-it-security-analyst-2.json","meta":{"generated_at":"2026-11-01T20:11:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":31032,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4449854},"rest":"https://alion.io/mcp/rest/get_company?id=4449854"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnovalink-solutions-llc-it-security-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnovalink-solutions-llc-it-security-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnovalink-solutions-llc-it-security-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/novalink-solutions-llc-it-security-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnovalink-solutions-llc-it-security-analyst-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3096396}},{"tool":"search_jobs","arguments":{"company":"novalink-solutions.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3096396},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}