Job Description
Key Required Skills:
Working knowledge of NIST SP 800-63-4, fraud prevention, identity verification, risk analysis, cybersecurity, financial crime, or a related field.

Position Description:

• Analyze documents and conduct intake and elicitation sessions with project teams.
• Decompose applications or services into the analytical components required for impact assessment.
• Conduct initial impact assessments and document the chain of reasoning supporting each determination.
• Document each application or service's impact assessment, assurance level selections, and any tailoring decisions.
• Re-engage with project teams when service scope, user populations, transaction types, or threat conditions change in ways that affect prior risk and determination.
• Produce analytical written products - risk assessments, impact assessments, security plan sections, control assessment reports, or equivalent.
• Applying a normative framework (NIST SP 800-63, 800-30, 800-37, or equivalent) to a specific service and producing a written analysis that shows the judgments made at each step.

(Basic Qualifications)
Bachelor's or higher degree in Computer Science, Information Systems, Cybersecurity, Mathematics, Statistics, Philosophy, Law, Economics, or a related analytical discipline.
Working knowledge of NIST SP 800-63-4, especially the base volume, and the NIST Risk Management Framework (SP 800-37).

(Required Skills)
**Selected candidate must be able to obtain and maintain a public trust clearance**
**Selected candidate must be willing to work on-site in Woodlawn, MD 5 days a week**
**Master's and 5+ years of experience, Bachelor's and 7+ years of experience or 13+ years in lieu of a degree**

• Experience in fraud prevention, identity verification, risk analysis, cybersecurity, financial crime, or a related field.
• Direct experience conducting digital identity risk assessments under NIST SP 800-63 (Revision 3 or 4) for production online services

Experience following the below steps:
- Analytical decomposition: Reliably breaks complex systems into the components required for the analysis.
- Rubric application: Applies a written rating rubric to a specific case by identifying the rubric row that matches the case and recording the corresponding rating. Does not substitute personal judgment for the rubric where the rubric is determinative.
- Categorical reasoning: Can determine whether an impact category applies to a given situation before rating its severity.
- Source-and-direction tracking: Distinguishes information the system holds about a user from information the user provided to the system.
- Elicitation: Obtains required information from stakeholders, particularly when the information initially received is incomplete or conflicting.
- Written precision: Produces clear analytical prose. Reasoning is traceable. Conclusions are tied to evidence.
- Critical thinking: Evaluates information and arguments for soundness, identifies unstated assumptions, and distinguishes claims that are supported from those that are not.
- Self-direction: Manages a queue of assessments without daily supervision and surfaces blockers early.

(Desired Skills)

• Professional certifications: CISSP, CISA, CIPP/G, or equivalent would be a plus.
• Strong attention to detail and organizational skills.
• Proficiency with Microsoft Excel and standard business applications.
• Ability to manage multiple priorities in a fast-paced environment while maintaining accuracy.

Benefits include:

• Comprehensive medical, dental, vision, life, and short & long-term disability insurance + health savings account
• Matching 401k retirement plan + IRA's and Roth IRA's
• Generous paid time off and paid holidays
• Employee recruitment/referral bonus
• Paid community service hours
• Tuition reimbursement
• Employee discounts