Cyber Risk Management Analyst Jr

asmexternalcareersite; Ashburn (VA); On-site; USD 110,000 - 150,000; Full time

Job summary

ASM Research is seeking a Cyber Risk Management Analyst to support identification, communication, and distribution of cybersecurity risks and actionable mitigations within the agency's IT environment.

You will work with operational teams to identify tactical risks, review change requests, prioritize vulnerability remediation, and contribute to strategic risk assessments and risk profiles. Strong collaboration and communication skills are essential.

Qualifications

• Bachelor's Degree in Computer Science or a related field or equivalent experience.
• Minimum 3 years of information security experience, including cyber risk management.
• US citizenship with ability to pass federal background check.

Responsibilities

• Identify tactical cyber risks with operations teams (VAT, SOC, CTI).
• Review and recommend approvals of tactical level change requests.
• Prioritize remediation of vulnerabilities.
• Use MITRE ATT&CK to identify gaps and guide funding for remediation across multiple systems.
• Support strategic risk assessment through collaboration with SCAs, ISSMs, ISSOs, and system owners.
• Produce risk profiles and assist in risk acceptance memoranda and POA&Ms.
• Communicate cyber risk posture to senior management and stakeholders.

Job description

The Cyber Risk Management Analyst will support identification, communication, and distribution of cybersecurity risks and actionable mitigations or remediations at the tactical and strategic levels within the agency's information technology environment.

• Assist the Government in identifying tactical risks through working with the operational teams such as the VAT, SOC, CTI, along with other applicable teams and data to create a full picture of the tactical cyber risks.
• Assist the Government in conducting reviews and recommendations for approvals of tactical level change requests.
• Assist the Government with the prioritization of vulnerability remediation.
• Support the identification of common gaps in the information system security using methods such as the MITRE ATT&CK framework to focus recommendations to Government regarding holistic funding in support of remediating security gaps for multiple systems.
• Support the identification of strategic risks through working with the Security Control Assessors (SCAs), Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), system owners, and other applicable teams to gather data for the creation of a full picture of the strategic cyber risks.
• Support the Risk Assessment (RA) Initiative by conducting Risk Assessments for agency systems by gathering data on security incidents, vulnerabilities, Plan of Actions & Milestones (POA&Ms), Known Exploited Vulnerabilities (KEVs), Loss Magnitude Metrics, Threat Actors, and TTPs.
• Assist the Government in developing and maintaining a risk tolerance level through working with senior management to formally establish the level of acceptable risk.
• Assist the Government in developing information system risk profiles in alignment with the NIST Cybersecurity Framework.
• Assist the Government in conducting reviews and recommendations to aid the Government in approving risk acceptance memoranda, assist with the prioritization of POA&Ms, create risk profiles for all information systems, and identify common gaps in the information system compliance to focus holistic funding in support of remediating security findings for multiple systems.
• Assist the Government in creating a holistic picture of the cyber risks and effectively communicate the risks to the applicable stakeholders and senior management.
• Assist the Government in providing briefings for senior management on the cyber risk posture of the agency.
• Assist the Government in historical tracking and reporting of current trends on cybersecurity events and incidents, including but not limited to phishing, malware, and scanning / probing activity to develop probabilities for future occurrences.
• Assist with creating and reviewing documentation and processes concerning Cybersecurity Supply Chain Risk Management (C-SCRM).

Minimum Qualifications

• Bachelor’s Degree in Computer Science or a related field or equivalent experience.
• Minimum 3 years of information security experience, to include experience related to cyber security risk management.
• Candidates must be US citizens (no dual citizens) with the ability to pass a federal background investigation in order to be granted access to sensitive information.

Other Job Specific Skills

• Strong understanding of IT cyber security tools, hardware/software security implementation, and communication protocols.
• Familiarity with MITRE ATT&CK framework.
• Strong written and verbal communication skills.

Compensation Ranges

Compensation ranges for ASM Research positions vary depending on multiple factors; including but not limited to, location, skill set, level of education, certifications, client requirements, contract-specific affordability, government clearance and investigation level, and years of experience. The compensation displayed for this role is a general guideline based on these factors and is unique to each role. Monetary compensation is one component of ASM's overall compensation and benefits package for employees.

EEO Requirements

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions.

We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age.

All decisions on employment are made to abide by the principle of equal employment.

Physical Requirements

The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties' or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.

Disclaimer

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.