Senior Cyber Risk Lead - Strategic Mitigation & Reporting

Dunhill Professional Search & Government Solutions; Ashburn (VA); On-site; USD 170,000 - 190,000; Full time

Job summary

Dunhill Professional Search & Government Solutions is seeking a Cyber Risk Management Lead to identify and communicate tactical and strategic cybersecurity risks across a large federal IT environment. You will coordinate with vulnerability assessment, security operations, threat intelligence teams, and system owners to brief senior management on risk posture.

The role emphasizes risk assessments, RMF/NIST CSF, and risk documentation, with a requirement for US citizenship and ability to pass a

Qualifications

• Bachelor's degree in Information Assurance, Computer Science or a related field.
• At least 7 years of professional experience in information assurance, cybersecurity, risk management or compliance; or, with a bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity or a related field, at least 5 years of such experience.
• One of the following certifications: CompTIA Security+, ISC2 CISSP, ISACA CISM, ISACA CRISC, GIAC GCED or CEH.
• Demonstrated experience with risk assessments, NIST SP 800-37 RMF, the NIST Cybersecurity Framework and NIST SP 800-53 security controls.
• Experience managing POA&Ms, reviewing vulnerability scan results, reviewing audit logs in an enterprise logging system, and reviewing OS, application and database security baseline configurations.
• Experience performing security impact analysis on change requests and writing security policy.
• Understanding of OMB M-22-09 and the Zero Trust Architecture pillars.
• US Citizenship (no dual citizenship) and the ability to pass a federal background investigation in order to be granted access to sensitive information.

Responsibilities

• Identify tactical risks by working with vulnerability assessment, security operations and cyber threat intelligence teams; review and approve/deny tactical change requests.
• Support prioritization of vulnerability remediation and identify common security-gap patterns using MITRE ATT&CK.
• Identify strategic risks by working with Security Control Assessors, ISSMs, ISSOs and system owners; assist cyber acquisition risk management through templates and guidance tied to acquisition decision events.
• Develop and review Risk Assessment Reports (RARs) and Cyber Risk Recommendation Memos.
• Conduct risk assessments, gathering data on incidents, vulnerabilities, POA&Ms, Known Exploited Vulnerabilities, loss-magnitude metrics, threat actors and TTPs.
• Support development of an organizational risk tolerance level and information system risk profiles aligned to the NIST Cybersecurity Framework.
• Maintain a near-real-time risk management dashboard and cybersecurity risk register for senior management visibility.
• Brief senior management on cyber risk posture and support Cybersecurity Supply Chain Risk Management (C-SCRM) documentation.

Skills

Risk assessments

RMF (NIST SP 800-37)

NIST CSF

Security controls

POA&Ms management

Security policy writing

OMB M-22-09 familiarity

US Citizenship background clearance

Education

Bachelor's degree in Information Assurance

Bachelor's degree in Computer Science

Job description

Dunhill Professional Search & Government Solutions is seeking a Cyber Risk Management Lead to identify and communicate tactical and strategic cybersecurity risks across a large federal IT environment. You will coordinate with vulnerability assessment, security operations, threat intelligence teams, and system owners to brief senior management on risk posture.

The role emphasizes risk assessments, RMF/NIST CSF, and risk documentation, with a requirement for US citizenship and ability to pass a