cybersecurity risk management

CompQsoft Inc; New York (NY); In loco; USD 85.000 - 115.000; Tempo pieno

Descrizione del lavoro

State Client is seeking a Cyber Risk Analyst in Brooklyn, NY to drive enterprise cybersecurity risk management by transforming compliance into strategic advantage. You will quantify risks, assess control effectiveness, and align with NIST 800-53 and RMF standards.

Collaborate with Cybersecurity Engineers and Business Analysts to define guardrails, prioritize remediation, and track key cyber risks while conducting audits and fostering awareness programs to strengthen security posture.

Competenze

• GRC and risk management experience required.
• Familiarity with NIST 800-53 and 800-37 RMF.
• Experience with risk register and POA&M lifecycle.
• Security awareness content development to reduce risk.
• Ability to translate vulnerabilities into business impact.

Mansioni

• Lead enterprise-wide risk assessments using GRC methods.
• Maintain and monitor the enterprise Risk Register and POA&M.
• Develop and implement security awareness programs.
• Collaborate with Cybersecurity Engineers and Business Analysts.
• Track key cyber risks and produce dashboards for leadership.
• Ensure alignment with NIST frameworks and RMF.

Conoscenze

GRC methodologies

TPRM

NIST SP 800-53

NIST RMF

POA&M lifecycle

Risk register

Security awareness content

Risk assessment leadership

Power BI

Excel

Archer/ServiceNow

OneTrust/Prevalent

Strumenti

Archer

ServiceNow

Power BI

Excel

JIRA

OneTrust

Prevalent

KnowBe4

Proofpoint

Descrizione del lavoro

Client: State Client

Certification: CISA, CRISC, CGEIT, CISSP, CompTIA Security+, CCSK, CAP/ISC2 CGRC Drive enterprise cybersecurity risk management by transforming compliance into a strategic advantage. Quantify risks, assess control effectiveness, and ensure alignment with NIST 800-53 and FISMA frameworks. Collaborate with Cybersecurity Engineers and Business Analysts to define compliance guardrails, prioritize remediation, and track key cyber risks. Conduct enterprise-wide risk assessments, audits, and user awareness programs to reduce risk and continuously improve the organization’s security posture.

Position: Cyber Risk Analyst

Location: Brooklyn, NY

Client: State Client

Certification: CISA, CRISC, CGEIT, CISSP, CompTIA Security+, CCSK, CAP/ISC2 CGRC Drive enterprise cybersecurity risk management by transforming compliance into a strategic advantage. Quantify risks, assess control effectiveness, and ensure alignment with NIST 800-53 and FISMA frameworks. Collaborate with Cybersecurity Engineers and Business Analysts to define compliance guardrails, prioritize remediation, and track key cyber risks. Conduct enterprise-wide risk assessments, audits, and user awareness programs to reduce risk and continuously improve the organization’s security posture.

Key Requirements

• Expertise in GRC methodologies, third-party risk management (TPRM), and federal compliance (NIST SP 800-53, 800-37). Skilled in Risk Register tracking and maintenance, performing Security Impact Analyses, managing the POA&M lifecycle, and developing security awareness content to mitigate human-centric risks.
• Risk Identification & Quantification: Lead enterprise-wide risk assessments using GRC methodologies to identify, evaluate, and prioritize risks, translating technical vulnerabilities into business impact for stakeholders.

17

17

• Regulatory & Framework Alignment: Ensure ongoing compliance with federal frameworks, including NIST SP 800-53 and 800-37 (RMF), through periodic audits and Security Impact Analyses for new and existing system interconnections.
• Strategic POA&M & Risk Register Oversight: Maintain and manage the enterprise Risk Register, tracking key cyber risks and overseeing the full lifecycle of Plans of Action and Milestones (POA&M), ensuring findings are documented, validated, and remediated within defined SLAs.
• Key Cyber Risk Tracking: Continuously monitor and report critical cyber risks, using risk dashboards and metrics to provide actionable insights to leadership and maintain enterprise risk posture.
• Human-Centric Risk & Awareness: Design and implement security awareness programs and phishing simulations (e.g., KnowBe4, Proofpoint) to reduce social engineering risks and strengthen organizational security culture.
• Technical Remediation Partnership: Collaborate with Cybersecurity Engineers and Business Analysts to define compliance guardrails and prioritize remediation activities based on risk impact.
• Advanced Risk Analytics & Visualization: Leverage GRC platforms (Archer, ServiceNow) and tools like Power BI and Excel to generate automated risk metrics, heat maps, and executive-level security posture reports.

Experience: 3+ years

Certifications: CISA, CRISC, CGEIT, CISSP, Security+, CCSK, or CGRC.

Technologies: GRC Platforms (Archer/ServiceNow), TPRM Tools (OneTrust/Prevalent), Awareness Platforms (KnowBe4/Proofpoint), MS Power BI, Excel (Advanced), and JIRA