Cyber Risk Management Lead

Cyber Risk Management Lead

On site in Ashburn, VA - Monday through Friday, 8:30am to 5:00pm

The Cyber Risk Management Lead leads the identification, communication and distribution of cybersecurity risks and actionable mitigations at both the tactical and strategic levels across a large federal IT environment. The Lead works closely with vulnerability assessment, security operations and cyber threat intelligence teams, Security Control Assessors, ISSMs, ISSOs and system owners to build a complete picture of cyber risk and to brief senior management on the organization's cyber risk posture.

Responsibilities:

• Identify tactical risks by working with vulnerability assessment, security operations and cyber threat intelligence teams; review and recommend approval or denial of tactical change requests.
• Support prioritization of vulnerability remediation and identify common security-gap patterns using frameworks such as MITRE ATT&CK.
• Identify strategic risks by working with Security Control Assessors, ISSMs, ISSOs and system owners; support cyber acquisition risk management through templates and guidance tied to acquisition decision events.
• Develop and review Risk Assessment Reports (RARs) and Cyber Risk Recommendation Memos.
• Conduct risk assessments, gathering data on incidents, vulnerabilities, POA&Ms, Known Exploited Vulnerabilities, loss-magnitude metrics, threat actors and TTPs.
• Support development of an organizational risk tolerance level and information system risk profiles aligned to the NIST Cybersecurity Framework.
• Maintain a near-real-time risk management dashboard and cybersecurity risk register for senior management visibility.
• Brief senior management on cyber risk posture and support Cybersecurity Supply Chain Risk Management (C-SCRM) documentation.

Requirements:

• Bachelor's degree in Information Assurance, Computer Science or a related field.
• At least 7 years of professional experience in information assurance, cybersecurity, risk management or compliance; or, with a bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity or a related field, at least 5 years of such experience.
• One of the following certifications: CompTIA Security+, ISC2 CISSP, ISACA CISM, ISACA CRISC, GIAC GCED or CEH.
• Demonstrated experience with risk assessments, NIST SP 800-37 RMF, the NIST Cybersecurity Framework and NIST SP 800-53 security controls.
• Experience managing POA&Ms, reviewing vulnerability scan results, reviewing audit logs in an enterprise logging system, and reviewing OS, application and database security baseline configurations.
• Experience performing security impact analysis on change requests and writing security policy.
• Understanding of OMB M-22-09 and the Zero Trust Architecture pillars.
• US Citizenship (no dual citizenship) and the ability to pass a federal background investigation in order to be granted access to sensitive information.

Compensation: $170,000 - $189,500 per year

#cjpost