Cyber Risk Management Analyst Jr

ASM Research • Ashburn, VA

1d

About The Position

The Cyber Risk Management Analyst will support identification, communication, and distribution of cybersecurity risks and actionable mitigations or remediations at the tactical and strategic levels within the agency's information technology environment.

Requirements

• Bachelor’s Degree in Computer Science or a related field or equivalent experience.
• Minimum 3 years of information security experience, to include experience related to cyber security risk management.
• Candidates must be US citizens (no dual citizens) with the ability to pass a federal background investigation in order to be granted access to sensitive information.
• Strong understanding of IT cyber security tools, hardware/software security implementation, and communication protocols.
• Familiarity with MITRE ATT&CK framework.
• Strong written and verbal communication skills.

Responsibilities

• Assist the Government in identifying tactical risks through working with the operational teams such as the VAT, SOC, CTI, along with other applicable teams and data to create a full picture of the tactical cyber risks.
• Assist the Government in conducting reviews and recommendations for approvals of tactical level change requests.
• Assist the Government with the prioritization of vulnerability remediation.
• Support the identification of common gaps in the information system security using methods such as the MITRE ATT&CK framework to focus recommendations to Government regarding holistic funding in support of remediating security gaps for multiple systems.
• Support the identification of strategic risks through working with the Security Control Assessors (SCAs), Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), system owners, and other applicable teams to gather data for the creation of a full picture of the strategic cyber risks.
• Support the Risk Assessment (RA) Initiative by conducting Risk Assessments for agency systems by gathering data on security incidents, vulnerabilities, Plan of Actions & Milestones (POA&Ms), Known Exploited Vulnerabilities (KEVs), Loss Magnitude Metrics, Threat Actors, and TTPs.
• Assist the Government in developing and maintaining a risk tolerance level through working with senior management to formally establish the level of acceptable risk.
• Assist the Government in developing information system risk profiles in alignment with the NIST Cybersecurity Framework.
• Assist the Government in conducting reviews and recommendations to aid the Government in approving risk acceptance memoranda, assist with the prioritization of POA&Ms, create risk profiles for all information systems, and identify common gaps in the information system compliance to focus holistic funding in support of remediating security findings for multiple systems.
• Assist the Government in creating a holistic picture of the cyber risks and effectively communicate the risks to the applicable stakeholders and senior management.
• Assist the Government in providing briefings for senior management on the cyber risk posture of the agency.
• Assist the Government in historical tracking and reporting of current trends on cybersecurity events and incidents, including but not limited to phishing, malware, and scanning / probing activity to develop probabilities for future occurrences.
• Assist with creating and reviewing documentation and processes concerning Cybersecurity Supply Chain Risk Management (C-SCRM).

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level