Government and Infrastructure - Cybersecurity Risk Senior

EY•Richmond, VA

5d•$77,500 - $160,500

About The Position

EY’s Government & Public Sector practice provides consulting and audit services to federal, state, local, and education clients. This role supports government clients in achieving their missions through cybersecurity work and is focused on implementing, documenting, and self-assessing security controls in accordance with the NIST Risk Management Framework (RMF). The Senior should have hands-on familiarity with federal frameworks and guidance and be able to guide systems through the full RMF lifecycle: categorization, control selection, implementation, assessment, authorization, and continuous monitoring. The Senior provides cybersecurity troubleshooting, analysis, and technical expertise while overseeing junior team members’ work. The position contributes to large-scale cybersecurity engagements, client service delivery, risk and supply-chain initiatives, strategy and roadmap development, and RMF assessment and authorization operations. Work may take place at client, EY, or contractor sites. Travel of 20–30% or more may be required depending on client and project needs.

Requirements

Bachelor’s degree in a related field.
At least 3 years of related work experience.
Ability to obtain and maintain a Secret-level clearance or higher.
Working knowledge of security frameworks and standards such as NIST 800-37, NIST 800-53, FIPS 199, FIPS 200, NIST CSF, NIST 800-161, and CMMC, as well as cybersecurity laws and regulations such as FISMA.
Experience in one or more of the following areas: cybersecurity assessments; IT and cybersecurity policies, standards, procedures, and controls; cybersecurity strategies and roadmaps; cybersecurity awareness and training; cybersecurity metrics and reporting; cybersecurity organization design and implementation; cybersecurity and risk-management solution design and implementation; federal RMF solution operations; or cybersecurity and IT architecture.
Forward-thinking, self-motivated approach, with the ability to thrive on new challenges and adapt to learning new knowledge.
Strong analytical and problem-solving skills.
Strong presentation and communication skills.
Ability to work collaboratively in a team environment.
Willingness to travel 20–30% or more, depending on client and project needs.

Nice To Haves

Consulting experience or experience working on technical projects.

Responsibilities

Provide cybersecurity troubleshooting, analysis, and technical expertise, and oversee the work of junior team members.
Assist in coordinating large-scale cybersecurity engagements.
Assess cybersecurity controls, programs, and strategies using proprietary and industry frameworks.
Operate SRC&R solutions according to engagement-defined policies and procedures.
Review cybersecurity measurements and monitor development and operations.
Assist in developing cybersecurity strategies and roadmaps.
Assist with NIST RMF and Assessment and Authorization enhancement, operations, and governance.
Support cybersecurity-focused Supply Chain Risk Management and/or Third-Party Risk Management operations, assessments, and enablement.
Design and re-engineer cybersecurity processes.
Monitor progress, manage risk, and keep stakeholders informed about progress and expected outcomes.
Use knowledge of industry trends to identify engagement and client-service issues, and communicate them to the on-site engagement team through written correspondence and verbal presentations.
Help support and manage GPS SRC&R consultants in the service delivery center.
Develop and review reports and presentations for technical and executive audiences.
Mentor and coach staff to develop their technical and consulting skills.
Work with the engagement manager to co-lead and own multiple parts of engagement delivery.
Deliver quality client services and drive high-quality work products within expected timeframes and budget.
Support implementation, documentation, and self-assessment of security controls throughout the RMF lifecycle, including categorization, control selection, implementation, assessment, authorization, and monitoring.