Senior Cyber Risk & Third-Party Assessments

Capital One; Richmond (VA); On-site; USD 147,000 - 168,000; Full time

Job summary

Capital One is seeking an Information Security professional to lead cyber third party risk assessments, collaborating with cross-functional teams to understand operational and technical aspects of third party engagement.

You will analyze control environments against security expectations, prepare executive summaries and evidence, and manage stakeholder relationships while traveling up to 40% for multi-day assessments.

Qualifications

• Bachelor's Degree required.
• 3+ years in cybersecurity or IT.
• 2+ years evaluating or supporting cybersecurity capabilities.
• 3+ years with frameworks like NIST CSF, MITRE ATT&CK, CMMC, FedRAMP.
• 3+ years analyzing cyber threats, vulnerabilities, or risks.
• 2+ years in PCI DSS, NIST, ISO, SOC 2, or third-party risk management.
• 2+ years in multi-cloud environments.
• 2+ years using security tools like Splunk, CrowdStrike, Qualys, AWS Security Hub.
• 1+ years developing cybersecurity metrics or dashboards.

Responsibilities

• Support kick-off, planning and scoping activities for cyber-focused risk assessments, working with cross functional resources to understand the operational and technical aspects of Third Party engagement service model
• Analyze Third Party control environment data against Capital One security expectations; interpreting information security requirements and reasonably apply them to specific situations.
• Review and support execution and delivery of reports including executive summaries and work papers detailing the assessment. work completed, evidence reviewed, and identified gaps.
• Maintain relationships with Third Party management, and other Enterprise colleagues to manage expectations of assessments and remediation including timing and assessment deliverables
• Work autonomously to assess needs, identify insights, and drive actions forward with stakeholders
• Stay current with industry trends and best practices through participation in external organizations to bring recommendations back to the team and support program development
• Travel 30-40%, which may include off-site locations, to perform multi day assessments.

Skills

Cybersecurity

Risk assessment

Stakeholder comms

Cybersecurity frameworks

Threat analysis

Multi-cloud

Security tools

Incident analysis

Education

Bachelor's Degree

Tools

Splunk

CrowdStrike

Qualys

AWS Security Hub

Job description

Capital One is seeking an Information Security professional to lead cyber third party risk assessments, collaborating with cross-functional teams to understand operational and technical aspects of third party engagement.

You will analyze control environments against security expectations, prepare executive summaries and evidence, and manage stakeholder relationships while traveling up to 40% for multi-day assessments.