Bachelor's Degree in Computer Science or related field, or equivalent experience
5+ years of information security experience, specifically in cyber security risk management
US Citizenship required, no dual citizenship
Strong understanding of IT cyber security tools and protocols
Familiarity with the MITRE ATT&CK framework
Excellent written and verbal communication skills
Responsibilities
Assist in identifying tactical cyber risks by collaborating with operational teams
Conduct reviews and provide recommendations for tactical change requests
Prioritize vulnerability remediation efforts
Identify security gaps using the MITRE ATT&CK framework for holistic funding recommendations
Support strategic risk identification by gathering data from various security teams
Conduct Risk Assessments for agency systems, analyzing security incidents and vulnerabilities
Develop and maintain risk tolerance levels in collaboration with senior management
Benefits
Comprehensive health insurance options
Retirement savings plans
Professional development opportunities
Flexible work arrangements
Supportive work environment focused on cybersecurity excellence
Full Job Description
The Cyber Risk Management Analyst will support identification, communication, and distribution of cybersecurity risks and actionable mitigations or remediations at the tactical and strategic levels within the agency's information technology environment.
Assist the Government in identifying tactical risks through working with the operational teams such as the VAT, SOC, CTI, along with other applicable teams and data to create a full picture of the tactical cyber risks.
Assist the Government in conducting reviews and recommendations for approvals of tactical level change requests.
Assist the Government with the prioritization of vulnerability remediation.
Support the identification of common gaps in the information system security using methods such as the MITRE ATT&CK framework to focus recommendations to Government regarding holistic funding in support of remediating security gaps for multiple systems.
Support the identification of strategic risks through working with the Security Control Assessors (SCAs), Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), system owners, and other applicable teams to gather data for the creation of a full picture of the strategic cyber risks.
Support the Risk Assessment (RA) Initiative by conducting Risk Assessments for agency systems by gathering data on security incidents, vulnerabilities, Plan of Actions & Milestones (POA&Ms), Known Exploited Vulnerabilities (KEVs), Loss Magnitude Metrics, Threat Actors, and TTPs.
Assist the Government in developing and maintaining a risk tolerance level through working with senior management to formally establish the level of acceptable risk.
Assist the Government in developing information system risk profiles in alignment with the NIST Cybersecurity Framework.
Assist the Government in conducting reviews and recommendations to aid the Government in approving risk acceptance memoranda, assist with the prioritization of POA&Ms, create risk profiles for all information systems, and identify common gaps in the information system compliance to focus holistic funding in support of remediating security findings for multiple systems.
Assist the Government in creating a holistic picture of the cyber risks and effectively communicate the risks to the applicable stakeholders and senior management.
Assist the Government in providing briefings for senior management on the cyber risk posture of the agency.
Assist the Government in historical tracking and reporting of current trends on cybersecurity events and incidents, including but not limited to phishing, malware, and scanning / probing activity to develop probabilities for future occurrences.
Assist with creating and reviewing documentation and processes concerning Cybersecurity Supply Chain Risk Management (C-SCRM).
Minimum Qualifications
Bachelor's Degree in Computer Science or a related field or equivalent experience.
Minimum 5 years of information security experience, to include experience related to cyber security risk management.
US Citizenship / no dual
Other Job Specific Skills
Strong understanding of IT cyber security tools, hardware/software security implementation, and communication protocols.
Familiarity with MITRE ATT&CK framework.
Strong written and verbal communication skills.
Compensation Ranges
Compensation ranges for ASM Research positions vary depending on multiple factors; including but not limited to, location, skill set, level of education, certifications, client requirements, contract-specific affordability, government clearance and investigation level, and years of experience. The compensation displayed for this role is a general guideline based on these factors and is unique to each role. Monetary compensation is one component of ASM's overall compensation and benefits package for employees.
