Security & Compliance Analyst

Security & Compliance Analyst

Starting Salary Range: $65,000 - $100,000

The State Corporation Commission’s (SCC) Health Benefit Exchange (HBE) division seeks an experienced Security & Compliance Analyst interested in a rewarding public service career to join its Information Security team. The Security & Compliance Analyst will work under the direction of the HBE Information Security Manager to safeguard the HBE’s consumer data and ensure compliance with state and federal regulations. This position offers a hybrid work schedule (some in-office and telework days each week) as well as a variety of professional development and training opportunities.

Essential Functions & Responsibilities

• Coordinate with federal agencies, SCC internal teams, vendors, and 3rd parties to perform privacy and security assessments, audits, and other security and privacy compliances activities
• Conduct complex audits of HBE partners and vendors to evaluate compliance with privacy and security requirements
• Lead and participate in internal assessments to evaluate compliance with information security and privacy policies, procedures, regulations, and agreements
• Monitor regulatory changes, evaluate impacts, and prepare reports and recommendations for compliance on security and privacy policies for HBE senior leadership
• Review and update security and privacy control documentation to ensure it is accurate, up to date, and adheres to legal and regulatory requirements
• Develop and present compliance findings from audits and assessments to HBE senior leadership and prepare remediation reports
• Develop, update, and support implementation of data security and privacy protection policies and procedures
• Coordinate with vendors and monitor complex security and privacy incidents
• Contribute to continuous improvement efforts
• Perform related work as required

Preferred Qualifications

• Two (2) or more years of professional experience in information security; governance, risks and compliance (GRC); and/or audit and compliance
• Experience with risk assessments, risk and vulnerability management, and incident response activities
• Experience reviewing privacy and security controls, performing or coordinating security audits or assessments, and developing policy or procedure documentation
• Familiarity with NIST 800-53 or other related security frameworks and/or with AWS or other cloud environments is required
• Bachelor’s degree in information security, information systems, computer science, or a related field is preferred, but not required with six (6) or more years of related experience
• Ability to research and remain up to date on regulatory compliance
• Ability to work independently and as part of a team
• Strong interpersonal skills and initiative
• Ability to establish and maintain effective working relationships with SCC staff, industry personnel, auditors, and HBE partners and vendors
• Excellent verbal and written communication skills
• Strong problem-solving, analytical, and organizational skills
• Ability to manage multiple priorities in a fast-paced environment
• Experience with information security regarding the health insurance industry and/or the Affordable Care Act is a plus
• CISA, CRISC, CGEIT, GRCP, CISM, or other related certifications are considered a plus

SCC Information

Located in downtown Richmond, the State Corporation Commission (SCC) is an independent state agency with regulatory authority over public utilities, insurance, state-chartered financial institutions, investment securities, retail franchising, and utility and railroad safety, as well as serving as the state’s central filing office for businesses. The SCC is also charged with administering Virginia’s health insurance marketplace. The SCC’s structure is unique. No other state has a single agency with such a broad array of regulatory responsibility.

The SCC offers our employees rewarding, impactful work; flexible telework options and work-life balance; and professional development opportunities. The SCC fosters a high-performing workforce with a commitment to diversity and inclusion, collaboration, and alignment with the SCC’s mission and strategic goals. Core benefits provided to SCC employees include competitive health and life insurance programs, pre-tax spending accounts, leave programs, and paid holidays. Employees participate in a state retirement plan with options for tax-deferred retirement savings including employer matching. The state funds a short and long-term disability program. As a state agency, SCC employees may be eligible for the federal Public Service Loan Forgiveness Program (PSLF).

The SCC regulates various companies and industries in Virginia. To avoid any conflict, employees are required to complete a Conflict of Interest Form disclosing securities they or their family members own or employment by a family member in a regulated company. Employees must dispose of securities in a regulated company.

The SCC prohibits immediate family members of an employee, including a spouse, child, stepchild, sibling, step- and half-sibling, parent, step-parent, or other household member of the employee, from working in the same Division or being in the same management hierarchy. In addition, the SCC prohibits romantic or intimate relationships among managers and employees in the same management hierarchy.

The SCC does not provide employer sponsorship. We use the E-Verify system to confirm identity and work authorization. The SCC is an Equal Opportunity Employer. As a Virginia Values Veterans (V3) Certified Employer, we value and encourage veterans and members of the Reserves and National Guard to apply.

The information you submit must clearly demonstrate your experience and qualifications as they relate to this position. Interview consideration is based on the information submitted online. If requested, the SCC will provide reasonable accommodation to applicants in need of accommodation to provide access to the application and interview process. A background investigation is conducted on the selected candidate as a condition of employment.

Depending on the selected candidate’s qualifications and experience, this position will be classified in the SCC Salary Structure as a grade 9 or 11 and will be non-exempt or exempt from the provisions of the Fair Labor Standards Act (FLSA). The starting salary will be commensurate with a candidate’s qualifications and experience and will be within the starting salary range posted in this advertisement.

How to Apply

Interested candidates are strongly encouraged to apply by November 14, 2026. If you are an external candidate, apply on the SCC Career Center website at https://careercenter.scc.virginia.gov.