Cybersecurity Senior Risk Analyst

Cybersecurity Senior Risk Analyst Job Description Justification: The Senior Risk Analysts will be responsible for implementing tools and practices to enhance processes related to third-party risk management, risk assessment, and general cyber risk governance. The position requires a diverse background in governance, risk, and compliance. analysis; technology implementation; project management; and collaboration with diverse groups of stakeholders to strengthen the overall security posture of the Agency. The Senior Risk Analysts will be expected to continue building an effective, organization-wide cybersecurity risk program. These analysts will be responsible for improving the risk assessment process to make it more user-centric, interviewing and communicating with internal departments when performing risk assessments, and driving the creation of a third-party vendor register and monitoring process. Analysts will review and analyze technologies for inventorying third parties, collaborate with subject matter experts to collect third-party intelligence and define actions based on it, and design steps for reviewing existing third parties within the vendor portfolio. Assignment Number and Title: Cybersecurity Senior Risk Analyst Work Location: ● On Site Scheduled Work Hours: Normal business hours, Monday through Friday, 35 hours per week (not including mandatory unpaid meal breaks after 6 hours of work) Scope of Services Tasks: ● Build new risk processes and implement risk frameworks to enable improved monitoring and evaluation of cybersecurity risks across the Agency; ● Manage complex, cross-functional projects while navigating ambiguity and implementation challenges. ● Collaborate with stakeholders across various divisions, incorporating feedback and aligning on risk management objectives. ● Evaluate cybersecurity risks associated with third parties engaged by the Agency. ● Document, monitor, and track risk remediation efforts within the Risk Register. ● Review and analyze cybersecurity risk cases, justifications, and exception documentation submitted by internal departments. ● Assist in the development of cybersecurity risk assessment procedures and testing methodologies based on recognized frameworks and guidelines. ● Initiate corrective actions to remediate identified vulnerabilities or control weaknesses. ● Engage in ongoing communication with internal Agency stakeholders. ● Support special projects and initiatives as assigned. Mandatory Skills / Experience Note: Candidates who do not meet the mandatory requirements will not be considered. ● A minimum of four (4) years of experience in risk management or cybersecurity risk assessment, or ● A minimum of four (4) years of experience evaluating and managing third-party risk within a cybersecurity or information security team. Desirable Skills / Experience ● Bachelor’s degree (BS/BA) in Cybersecurity, Risk Management, Information Systems, Computer Science, or a related field. Preferred Certifications (one or more): ● Certified Information Systems Auditor (CISA) ● Certified Information Systems Security Professional (CISSP) ● Certified in Risk and Information Systems Control (CRISC) ● Certified Information Security Manager (CISM) ● CompTIA Security+ ● CompTIA Network+ ● CompTIA A+ ● CompTIA CySA+ ● Cisco Certified Network Associate (CCNA) ● Certified Ethical Hacker (CEH) ● GIAC Information Security Fundamentals (GISF) ● GIAC Security Essentials (GSEC) ● (ISC)² Systems Security Certified Practitioner (SSCP) Additional competencies: ● Ability to work effectively in a collaborative team environment ● Strong organizational skills with a high level of motivation and self-direction. ● Knowledge of hardware, software, data, and network principles applicable to public and/or private sector environments. ● Understanding of operating systems, databases, and network architectures. ● Familiarity with recognized cybersecurity frameworks such as NIST, SANS, PCI, ISO 27001/27002, or CIS. ● Strong investigative and analytical capabilities. ● Excellent written and verbal communication skills. ● Awareness of the evolving cyber threat landscape. ● Knowledge of applicable laws, regulations, policies, and ethical standards related to cybersecurity and information privacy.