SCRM & AI Security Risk Analyst

K2United, LLC.; Washington (District of Columbia); On-site; USD 120,000 - 170,000; Full time

Job summary

K2United, LLC seeks a cybersecurity risk professional to support SCRM programs and AI security reviews across federal-facing technology. You will analyze third-party and tech risks, maintain SCRM records, and provide risk mitigation recommendations for software, systems, and services that use AI or emerging capabilities.

The role requires four-plus years in cybersecurity risk or vendor risk, a bachelor's in a related field, and strong written analysis skills.

Qualifications

• Bachelor's degree or equivalent in cybersecurity or IT.
• 4+ years in cybersecurity risk, third-party or vendor risk.
• Experience with third-party risk assessments and risk analyses.
• Familiarity with OMB M-21-30, M-22-18, M-23-16 and NIST SP 800-218.
• Strong written communication and deliverables.

Responsibilities

• Support the operation and enhancement of the client's SCRM activities, including documentation support, stakeholder coordination, and maintenance of SCRM records.
• Analyze third-party and technology-related security risks and prepare risk mitigation recommendations.
• Identify gaps in current SCRM practices and recommend improvements to process, monitoring, governance, and reporting.
• Support evaluation of the security posture of third-party technologies and evolving cyber risks.
• Support AI security-related compliance, vulnerability, and risk activities for software, systems, services, and tools incorporating AI-enabled functions or emerging technologies.
• Perform security review support and risk analysis; develop recommendations for secure implementation and governance considerations.
• Coordinate with stakeholders on the security implications of emerging technical capabilities.
• Support secure adoption assessments for modernization, automation, and analytics opportunities.
• Apply OMB M-21-30, M-22-18, and M-23-16; NIST software supply chain security guidance; NIST SP 800-218 (Secure Software Development Framework); and the NIST AI Risk Management Framework and Playbook.

Skills

SCRM knowledge

Vendor risk analysis

Security compliance analysis

Federal policy familiarity

Written communication

Education

Bachelor's degree in cybersecurity or IT

Tools

SBOM generation

Job description

K2United, LLC seeks a cybersecurity risk professional to support SCRM programs and AI security reviews across federal-facing technology. You will analyze third-party and tech risks, maintain SCRM records, and provide risk mitigation recommendations for software, systems, and services that use AI or emerging capabilities.

The role requires four-plus years in cybersecurity risk or vendor risk, a bachelor's in a related field, and strong written analysis skills.