Cyber Risk Management Analyst

What You’ll Do

• Drive the design, development, implementation, and continuous improvement of third-party cyber risk management strategies and practices across public and private sectors.
• Champion and oversee Third Party Cyber Risk Management (TPCRM) best practices and policies.
• Implement and adapt industry-standard cybersecurity frameworks (e.g., ISO 27001, NIST CSF, NIST 800-53, NIST 800-171, CIS 18, Zero Trust Principles, FedRAMP).
• Conduct supply chain risk assessments using recognized audit reports (e.g., SOC 2 Type II) and questionnaire responses.
• Collaborate with cross-functional leadership and stakeholders, particularly in supply chain management, to communicate third-party risk management strategies, activities, and identified risks.
• Utilize third-party risk assessment platforms (e.g., Process Unity GRX) and risk management platforms (e.g., Diligent RSAM).
• Review and make recommendations for policy and process updates, insuring alignment with organizational risk requirements.
• Lead and mentor diverse teams with varying levels of subject matter expertise.
• Prioritize and manage multiple concurrent projects to ensure timely completion.
• Produce high-quality technical documentation and reports.
• Engage in continuous learning to expand personal knowledge and upskill team members.

Required: Education + Experience

• 3+ years of experience in the security aspects of multiple platforms, operating systems, software, communications, and network protocols.
• Familiarity with third-party risk assessment platforms (e.g., Process Unity GRX) and risk management platforms (e.g., Diligent RSAM).
• Familiarity with cyber risk assessment and management frameworks, methodologies, and reporting. (e.g., SOC 2 Type II) and questionnaire responses.
• Strong understanding and practical experience in adapting and implementing industry-standard cybersecurity frameworks and standards (e.g., ISO 27001, NIST CSF, NIST 800-53, NIST 800-171, CIS 18, Zero Trust Principles, FedRAMP).
• Excellent communication skills to effectively engage with cross-functional leadership and stakeholders, particularly in supply chain management regarding third-party risk management strategies and activities.
• Experience in managing and instructing diverse teams with varying levels of subject matter expertise.
• Strong organizational skills to manage competing priorities and ensure timely completion of projects.
• Technical Writing Skills: Proficient in producing high-quality technical documentation and reports.

Security Clearance

• U.S. Citizenship required
• Ability to obtain Public Trust (or higher) government clearance

Preferred

• Bachelor’s degree in Computer Science, Information Technology or Information Security or other relevant disciplines.
• Public and Private Sector Experience
• Familiarity with CyberGRX (now Process Unity GRX) and Diligent RSAM
• Proximity to customer locations in the DMV (DC, MD, or VA) Metro area or Raleigh/Durham, NC is ideal.

Preferred Certifications

• CRISC - Certified in Risk and Information Systems Control
• CISSP- Certified Information Systems Security Professional
• CCSK- Certificate of Cloud Security Knowledge or CCSP
• CISA-Certified Information Systems Auditor certifications
• CISM- Certified Information Security Manager