Cyber Risk Management Analyst

CompQsoft Inc; Leesburg (VA); On-site; USD 120,000 - 128,000; Full time

Job summary

CompQsoft Inc. is seeking a senior GRC professional to drive enterprise cybersecurity risk management. You will quantify risks, assess control effectiveness, and align with NIST 800-53 and FISMA, collaborating with Cybersecurity Engineers and Business Analysts to define guardrails and remediation priorities.

You will lead risk assessments, audits, and user awareness programs, and oversee the POAandM lifecycle while reporting key risks to leadership using tools like Power BI and Excel.

Qualifications

• Expertise in GRC methodologies, third-party risk management (TPRM), and federal compliance (NIST SP 800-53, 800-37).
• Risk Register tracking and maintenance, performing Security Impact Analyses, managing the POAandM lifecycle, and developing security awareness content to mitigate human-centric risks.
• Lead enterprise-wide risk assessments to identify, evaluate, and prioritize risks, translating vulnerabilities into business impact for stakeholders.

Responsibilities

• Lead enterprise-wide risk assessments using GRC methodologies and translate technical vulnerabilities into business impact for stakeholders.
• Ensure ongoing compliance with federal frameworks (NIST SP 800-53/800-37 RMF) through audits and security analyses.
• Maintain and manage the enterprise Risk Register and the full lifecycle of POAandM with defined SLAs.
• Design and implement security awareness programs and phishing simulations to reduce social engineering risks.

Skills

GRC methodologies

TPRM

Regulatory compliance

Risk assessment

Risk quantification

Stakeholder communication

Tools

Archer

ServiceNow

OneTrust

Prevalent

KnowBe4

Proofpoint

Power BI

Excel

JIRA

Job description

Requirements

Drive enterprise cybersecurity risk management by transforming compliance into a strategic advantage. Quantify risks, assess control effectiveness, and ensure alignment with NIST 800-53 and FISMA frameworks. Collaborate with Cybersecurity Engineers and Business Analysts to define compliance guardrails, prioritize remediation, and track key cyber risks. Conduct enterprise-wide risk assessments, audits, and user awareness programs to reduce risk and continuously improve the organizations security posture.

Key Requirements

Expertise in GRC methodologies, third-party risk management (TPRM), and federal compliance (NIST SP 800-53, 800-37). Skilled in Risk Register tracking and maintenance, performing Security Impact Analyses, managing the POAandM lifecycle, and developing security awareness content to mitigate human-centric risks.

Risk Identification and Quantification: Lead enterprise-wide risk assessments using GRC methodologies to identify, evaluate, and prioritize risks, translating technical vulnerabilities into business impact for stakeholders.

Regulatory and Framework Alignment: Ensure ongoing compliance with federal frameworks, including NIST SP 800-53 and 800-37 (RMF), through periodic audits and Security Impact Analyses for new and existing system interconnections.

Strategic POAandM and Risk Register Oversight: Maintain and manage the enterprise Risk Register, tracking key cyber risks and overseeing the full lifecycle of Plans of Action and Milestones (POAandM), ensuring findings are documented, validated, and remediated within defined SLAs.

Key Cyber Risk Tracking: Continuously monitor and report critical cyber risks, using risk dashboards and metrics to provide actionable insights to leadership and maintain enterprise risk posture.

Human-Centric Risk and Awareness: Design and implement security awareness programs and phishing simulations (e.g., KnowBe4, Proofpoint) to reduce social engineering risks and strengthen organizational security culture.

Technical Remediation Partnership: Collaborate with Cybersecurity Engineers and Business Analysts to define compliance guardrails and prioritize remediation activities based on risk impact.

Advanced Risk Analytics and Visualization: Leverage GRC platforms (Archer, ServiceNow) and tools like Power BI and Excel to generate automated risk metrics, heat maps, and executive-level security posture reports.

Technologies: GRC Platforms (Archer/ServiceNow), TPRM Tools (OneTrust/Prevalent), Awareness Platforms (KnowBe4/Proofpoint), MS Power BI, Excel (Advanced), and JIRA.

CompQsoft provides equal opportunity in all aspects of employment and in the working environment to all employees and applicants. CompQsoft does not take any non-merit factors like race, color, religion, sex (gender), mental/physical disability, and age into account for purposes of recruitment, hiring and development.

Salary Description

$120000- $128000