Senior Cyber Risk Strategist — Remote US

Amentum

Austin (TX)

Remote

USD 110,000 - 130,000

Full time

10 days ago

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Health, dental, and vision insurance

401(k) matching

Educational reimbursement

Parental leave

Employee stock purchase plan

Disability and life insurance

Pet insurance

Job summary

Amentum is seeking a Senior Cybersecurity Risk Analyst to join the Cybersecurity Governance, Risk, and Compliance (GR&C) team. This senior IC role owns enterprise cyber risk assessment work and communicates risk to business leadership within the enterprise risk appetite.

The position is US remote telework and requires US citizenship. Travel up to 25% and strong knowledge of NIST and risk management are preferred.

Qualifications

Typically 8 years of hands-on cybersecurity experience, with demonstrated depth in evaluating real technology environments, not solely policy or audit administration.
Demonstrated experience in enterprise risk management and in third-party or vendor cyber risk assessment.
Current Security+ or an equivalent industry certification.
Must be a U.S. Citizen.
U.S. Remote-Telework role; must reside within the United States to work remotely.

Responsibilities

Conduct cyber risk assessments across the enterprise, identifying risk to confidentiality, integrity, and availability of systems and data.
Articulate cyber risk to business and technical leadership in clear, decision-ready terms.
Lead cyber risk reviews across third-party risk, temporary risk acceptance, and software risk, tracking AI development related to cyber risk.
Coordinate with Compliance to ensure risk treatment is coherent across frameworks.
Evaluate risk implications of technology decisions in networking, cloud, endpoint, and identity architectures.
Escalate residual risk beyond appetite and specify required risk reduction.
Contribute to scoping and architecture decisions with risk perspectives.
Improve GR&C processes: methodology, intake, risk reporting, evidence handling, and consistency of judgments.
Maintain currency on cyber risk, threats, technology, and regulations.