DataStaff Inc. is seeking a Business Analyst for a long-term contract opportunity with one of our direct clients located in Richmond, VA.
*This position is hybrid; 4 days will be onsite.
Responsibilities:
Conducts project initiation activities to identify new problems and objectives related to computer applications and identifies issues to be addressed in the Requirements Definition Phase.
Conducts requirements elicitation and documentation for new applications or enhancements to current applications.
Works with business and Information Systems staff to determine needs and produce an SDLC compliant Requirements Definition document that completely and clearly defines the requirements within the established time frame.
Ensures documented requirements are clear, concise, complete, and meet established agency guidelines and standards.
Assists with the development of applicable processes and templates as needed and directed by project leadership to ensure documentation is in a standard, easy to use, and repeatable format.
Attends application design and development scrum meetings to represent business needs and requirements during design and development processes.
Write and execute system test plans to verify the system meets all documented requirements.
Perform manual testing on web applications and verify successful completion of test plans.
Create testing plans to confirm that the application meets requirements and design specifications.
Document bugs and application insufficiencies with sufficient information to allow a developer to reproduce issues so they can be corrected.
Assist with the development of user testing scripts for User Acceptance Testing.
Knowledge, Experience and Abilities:
Experience manually performing testing on a web application.
Ability to write and execute test plans and scripts according to identified standards.
Ability to identify and document bugs or insufficiencies in a web application.
Required Skills:
8 Years - Extensive experience in business and systems analysis, requirements documentation, system development life cycle, and agile application development methodologies such as Scrum.
8 Years - Extensive experience defining and documenting user requirements from multiple sources, and preparing complex documents to effectively relay requirements.
8 Years - Extensive experience supporting application development, maintenance, and implementation, systems analysis and design, and business process improvement.
8 Years - Extensive experience defining and documenting business processes and mapping or developing processes in a new system.
8 Years - Considerable experience in testing complex systems to determine that business needs are met.
8 Years - Experience conducting meetings and documenting project decisions.
8 Years - Ability to successfully participate in a development team, help foster a team environment, and effectively communicate both orally and in writing.
Desired Skills:
2 Years - Familiarity with web application software development projects using .Net.
2 Years - Familiarity with documenting requirements in Microsoft Team Foundation Server.
This opportunity is available on a corp-to-corp basis or as a W2 position with a competitive benefits package. DataStaff, Inc. offers medical, dental, and vision coverage options as well as paid vacation, sick, and holiday leave. As many of our opportunities are long-term, we also have a 401k program available for employees after 6 months.
IT Security Analyst
Location:Richmond, Virginia
Remote:Remote
Type:Contract
Job#12810
DataStaff, Inc. is currently seeking an IT Security Analyst for a long-term contract opportunity with one of our direct clients in Richmond, VA.
*This is a remote role. However, the selected candidates must reside in Virginia or within a reasonable distance in the event they need to report on site for meetings as needed.
Job Description
The IT Security Governance Analyst supports the enterprise cybersecurity program by administering and improving governance, risk, compliance, privacy, and security assurance activities.
Responsibilities
Conduct and coordinate security risk assessments, Business Impact Analyses, data classifications, privacy reviews, control assessments, and security feasibility reviews for new and existing systems, applications, services, integrations, and technology initiatives.
Maintain risk registers, assessment records, corrective-action plans, exceptions, evidence repositories, and follow-up activities in Archer GRC and other approved agency tools. Track remediation commitments, due dates, residual risk, and required executive decisions.
Apply and interpret Commonwealth and agency requirements including VITA SEC530, NIST guidance, CIS Controls, DoD STIGs, CJIS, and VCIN requirements, and applicable HIPAA, PCI, FERPA, FTI privacy, and contractual obligations.
Partner with system owners and data owners to establish ownership, classify information, document security plans and controls, complete periodic reviews, and maintain evidence needed for authorization, audit, and ongoing compliance.
Review vendor and third-party security documentation including SOC reports, security questionnaires, architecture and data-flow information, contracts, MOUs, MOAs, NDAs, and other interconnection documentation. Identify conditions, gaps, compensating controls, and escalation needs.
Support interconnection and data-sharing governance by reviewing MOUs and related agreements for security, privacy, least-privilege, data-handling, access-control, incident-notification, and annual-review requirements.
Coordinate audit, assessment, and oversight activities, collect and validate evidence, respond to inquiries, document findings, and manage corrective actions through closure with internal audit and other authorized reviewers.
Develop, maintain, and communicate security policies, standards, procedures, guidelines, templates, and governance processes. Recommend practical improvements that strengthen compliance and reduce risk.
Support the agency security awareness and training program, including targeted compliance training, acknowledgements, tracking, reporting, and education for system owners, technical staff, and other stakeholders.
Perform governance reviews for emerging technology and artificial intelligence initiatives. Evaluate business purpose, data sensitivity, privacy, security, human oversight, vendor assurances, risks, and required approvals; document outcomes and handoffs.
Assist with security planning for continuity, incident response, disaster recovery, business continuity, audit logging, configuration, hardening, access reviews, vendor management, and other control areas.
Prepare accurate executive management and Commonwealth reporting on governance workload, system inventory, risks, findings, remediation progress, compliance status, metrics, and program priorities.
Provide clear security guidance to project teams, operational IT, procurement, business units, and vendors. Facilitate meetings, communicate requirements professionally, and escalate unresolved risk or noncompliance through established channels.
Participate in incident and post-incident governance activities including documentation review, control-gap identification, privacy or regulatory coordination, and corrective-action tracking.
Perform other related duties and special projects in support of the IT Security Governance program.
Knowledge, Abilities and Experience:
Knowledge of cybersecurity governance, risk management, compliance, privacy, third-party risk, and audit practices.
Knowledge of security frameworks and standards such as NIST 800-53, VITA SEC530, CIS Controls, CJIS, and VCIN requirements, HIPAA, PCI, FERPA, FTI, and related Commonwealth requirements.
Ability to analyze technical and business information, identify risk, distinguish control gaps from acceptable residual risk, and recommend clear, defensible actions.
Ability to develop and maintain professional documentation including assessment reports, risk registers, security plans, policies, procedures, executive briefings, and audit evidence.
Ability to manage multiple complex assignments, prioritize work under deadlines, and follow through on actions involving many stakeholders.
Ability to communicate effectively with executives, technical teams, vendors, auditors, and non-technical business partners.
Ability to handle sensitive information with sound judgment, discretion, and a service-oriented approach.
Preferred Knowledge and Experience:
Experience using Archer or comparable governance, risk and compliance platforms
Experience applying Commonwealth of Virginia information security requirements
Reviewing vendor security documentation, SOC reports, and security questionnaires
Conducting BIAs, data classification reviews, and security feasibility assessments
Working with CJIS, VCIN, HIPAA, PCI DSS, FERPA, or FTI requirements
Reviewing data-sharing agreements, MOUs, and security/privacy obligations
Supporting incident response, disaster recovery, or business continuity compliance
Assessing security, privacy, and compliance risks associated with emerging technologies
Preparing security metrics, compliance reports, risk summaries, and management briefings
Required Skills
5 Years - Experience in cybersecurity, information security, IT security governance, or risk management
3 Years - Experience performing security risk assessments, compliance reviews, or GRC activities
4 Years - Experience applying NIST security frameworks, including NIST SP 800-53
3 Years - Experience conducting security control assessments and supporting IT audits
3 Years - Experience maintaining risk registers, documenting findings, and tracking corrective actions
5 Years - Experience developing security documentation, policies, procedures, assessment reports, and executive summaries
3 Years - Strong written and verbal communication skills with technical teams, business owners, auditors, and leadership
3 Years - Ability to manage multiple security assessments, compliance activities, and competing deadlines
This opportunity is available on a corp-to-corp basis or as a W2 position with a competitive benefits package. DataStaff, Inc. offers medical, dental, and vision coverage options as well as paid vacation, sick, and holiday leave. As many of our opportunities are long-term, we also have a 401k program available for employees after 6 months.