GEICO's Cybersecurity organization has an exciting opportunity for an accomplished Engineer II - Third-Party Cyber Risk Management. This individual will play a key role within GEICO's Trustworthy Engineering organization, on the Third-Party Cyber Risk Management (TPCRM) team, with a focus on executing the day-to-day third-party inventory, assessment, reassessment, and data-sharing risk work that supports GEICO's third-party cyber risk program.

Position Description:

Our Engineer II - Third-Party Cyber Risk Management is responsible for assisting the TPCRM team's efforts to inventory GEICO's third-party ecosystem, execute risk-based security assessments and reassessments, and enforce secure data-sharing practices for third parties that access GEICO data. This includes maintaining and reconciling third-party records in industry-recognized risk assessment tools and related systems, working through the current backlog of third parties missing a required security assessment, supporting the team's quarterly commitment to complete all reassessments due, and helping monitor the effectiveness of implemented controls, under the guidance of senior engineers on the team.

Position Responsibilities

As an Engineer II, you will:

• Execute third-party security assessments and reassessments in industry-recognized tools, following defined standards for accuracy, completeness, and timeliness, with minimal guidance from senior engineers
• Prioritize and work through the inventory of third parties identified as missing a required TPCRM security assessment, helping the team reach 100% completion of outstanding reviews Implement defined industry-recognized risk assessment tools configuration items, including inventory attributes, assessment workflow steps, and reporting fields, in support of the broader TPCRM architecture set by senior engineers
• Reconcile third-party records across industry-recognized risk assessment tools and other enterprise systems to identify and close data gaps, and validate that data is shared with third parties using approved, secure data-sharing methods
• Support centralized tracking of third-party security issues by maintaining issue records, monitoring remediation status against SLAs, and escalating gaps to senior team members as needed Interest or experience in applying AI/automation (e.g., AI-assisted data classification, decisioning logic, or reporting) to streamline TPCRM workflows such as intake routing, low-risk auto-approvals, and dashboard generation, reducing manual effort across the assessment and reassessment process
• Contribute to quarterly and executive-level reporting on assessment, reassessment, and issue-management metrics, helping ensure the underlying data is accurate and current
• Collaborate with Supplier Management, Legal, Data Protection Engineering, and business stakeholders to gather the information needed to complete assessments and close third-party data-sharing gaps
• Continuously build proficiency with industry-recognized risk assessment tools, third-party risk frameworks, and the team's assessment methodologies, and seek out mentorship from senior engineers to grow technical and domain expertise
• Conduct root-cause analysis on data-quality issues or defects in third-party records and assessment workflows, and implement fixes under senior engineer guidance
• Support the team's roadmap by helping execute the underlying inventory, assessment, and reassessment work that feeds more advanced capabilities such as risk-based intake and continuous risk assessment
• Actively seek and apply feedback from teammates and senior engineers, share knowledge with the team, and help teammates work through obstacles and blockers when asked

Qualifications:

• Experience conducting risk or security assessments, or supporting reassessment/renewal processes, in a cybersecurity, IT risk, or vendor/third-party risk context
• Experience working with GRC, TPCRM, or workflow platforms (e.g., industry-recognized risk assessment tools, Archer, ServiceNow) to execute or track assessments, issues, or records
• Experience reconciling data across multiple systems and identifying/resolving data-quality gaps
• Working knowledge of cybersecurity and data-privacy regulations and standards relevant to third-party risk (e.g., NYDFS, NIST CSF)
• Familiarity with data security and third-party risk frameworks and protocols, such as ISO 27001, NIST, and CIS
• Strong analytical and problem-solving skills, with the ability to execute well-defined tasks reliably and escalate ambiguous issues to senior engineers
• Strong written and verbal communication skills, with the ability to build working relationships with teammates and cross-functional stakeholders such as Supplier Management and Legal
• A proactive, detail-oriented approach to high-volume, deadline-driven work, along with a willingness to seek mentorship and feedback to grow technical and domain expertise

One or more of the following cybersecurity certifications are highly desired:

• CompTIA Security+ (Sec+)
• CompTIA Cybersecurity Analyst+ (CYSA+)
• One or more of the following cybersecurity certifications are highly encouraged:
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Third-Party Risk Professional (CTPRP)

Experience:

• 1-2+ years of experience in cybersecurity, IT risk, or third-party/vendor risk management
• Experience with GRC/TPRM or workflow platforms (e.g., OneTrust, Archer, ServiceNow), or comparable ticketing/case-management tools, preferred
• Experience with data reconciliation, reporting, or dashboarding tools (e.g., Excel, Power BI, SQL) preferred
• Familiarity with cloud environments (AWS, GCP, or Azure) a plus

Education:

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or equivalent education or work experience

Annual Salary
$60,000.00 - $215,000.00
The above annual salary range is a general guideline. Multiple factors are taken into consideration to arrive at the final hourly rate/ annual salary to be offered to the selected candidate. Factors include, but are not limited to, the scope and responsibilities of the role, the selected candidate's work experience, education and training, the work location as well as market and business considerations.

GEICO will consider sponsoring a new qualified applicant for employment authorization for this position.