Government and Infrastructure-Risk Consulting-Enterprise Risk, Controls and Resilience - Manager

EY • McLean, VA

5d • $111,600 - $232,700 • Hybrid

About The Position

The Risk Consulting Manager will join EY’s Government & Infrastructure (G&I) Enterprise Risk, Controls & Resilience team, serving government organizations as a primary client and helping them govern risk, strengthen controls, and improve resilience. The team’s work includes internal controls management, including OMB Circular A-123 and Federal Managers’ Financial Integrity Act requirements; internal audit; integrated and enterprise risk management; third-party and vendor risk management; ethics and regulatory compliance; and enterprise resilience. Programs may be designed, transformed, or operated using AI, data analytics, automation, and Governance, Risk, and Compliance platforms.

The Manager leads engagements or major workstreams from planning through closure, owns engagement quality and economics, advises clients and agency leaders, and develops people. The role also contributes to practice growth by shaping offerings and methodologies, building client relationships, and leading business development and pursuit activities. Work may take place at client, EY, or contractor sites; the position is hybrid, with average travel of 25% to 30% or more depending on client and project needs.

Requirements

• Bachelor’s or master’s degree in Accounting, Finance, Business Administration, Economics, Risk Management, Public Administration, or a related discipline.
• At least 5 years of relevant experience in internal audit, internal controls, OMB Circular A-123, financial statement audit, audit readiness and control remediation, enterprise risk management, third-party or vendor risk management, compliance, or resilience, gained at a public accounting firm, professional services firm, government organization, or within industry.
• Demonstrated experience managing engagements or workstreams, including budgets and teams, and contributing to proposals or business development.
• A U.S. certification in at least one of the following: CPA, CIA, CGFM, CDFM, CA, CMA, RIMS-CRMP, FRM, CTPRP, or CBCP.
• U.S. citizenship and the ability to obtain and maintain a Secret clearance or higher.
• Willingness to travel on average 25% to 30% or more in a hybrid environment; work may be at client, EY, or contractor sites, and travel beyond the work-location area may be required based on client and project needs.
• Understanding of internal control and risk frameworks such as the GAO Green Book, COSO Internal Control and COSO ERM, and OMB Circular A-123, including control testing design and execution and risk and control self-assessment.
• Understanding of enterprise risk concepts, including risk identification, risk appetite and tolerance, key risk indicators, scenario analysis, third-party risk, and business continuity planning.
• Knowledge of federal business processes such as funds management, budget formulation and execution, receivables, disbursements, property management, human resources, financial reporting, and grants management, or comparable state, local, and education processes such as benefits programs.
• Knowledge of working paper documentation standards and internal audit standards, such as IIA Global Internal Audit Standards and GAGAS.
• Deep knowledge of third-party risk management practices and ability to design operating models and maturity roadmaps.
• Experience conducting resilience activities such as business impact analyses, critical process identification, dependency mapping, scenario analysis, tabletop exercises, recovery testing, and resilience assessments and roadmaps.
• Strong report-writing skills for communicating findings and recommendations to clients.
• Excellent communication skills for discussing observations and negotiating the acquisition of data for internal controls testing and reporting.
• Project and people management skills and experience, including leading blended teams that use onshore delivery centers.
• Ability and willingness to supervise and develop team members.
• Ability to research regulatory guidance, current industry standards and trends, and new legislation and requirements.
• Knowledge of how to effectively use firm-approved AI tools to enhance problem-solving and productivity, with sound judgment about AI-related risks and considerations.
• Ability to assess and articulate evolving risks AI presents to clients across multiple risk domains, including AI embedded in vendor products and services.

Nice To Haves

• Working knowledge of the U.S. Standard General Ledger (USSGL) and the Statements of Federal Financial Accounting Standards (SFFAS).
• Experience designing or leading ERM, third-party or vendor risk management, compliance, enterprise, business continuity, or operational resilience programs, such as applying ISO 22301, ISO 31000, or NIST SP 800-34, or controls monitoring delivered as a managed service.
• Experience implementing or configuring third-party risk management platforms such as ServiceNow Vendor Risk Management, Archer Third Party Governance, OneTrust, or ProcessUnity, and integrating vendor risk intelligence sources such as BitSight or SecurityScorecard.
• Familiarity with state internal control and internal audit statutes, such as Massachusetts Chapter 647 of the Acts of 1989, the New York State Governmental Accountability, Audit and Internal Control Act, Section 215.86 of the Florida Statutes, the Texas Internal Auditing Act, and the California State Leadership Accountability Act.
• Existing relationships with federal or state agencies and experience pursuing work on government contract vehicles.
• PMP or a similar project management certification.

Responsibilities

• Lead internal controls, internal audit, integrated and enterprise risk management, third-party risk, ethics and regulatory compliance, or enterprise resilience engagements or major workstreams from planning through closure.
• Serve as a direct point of contact for agency leaders, including CFOs, Chief Risk Officers, internal audit leaders, and program leaders; report status, manage expectations, and resolve issues.
• Advise on control and risk program design, including governance, risk appetite, A-123 and state internal control assessment strategy, audit-readiness roadmaps, internal audit transformation, ERM and third-party risk operating models, compliance programs, and resilience programs.
• Lead the design, build, and operation of third-party risk management programs, including governance and policy, risk appetite for vendor relationships, inherent risk tiering, risk-based due diligence standards, contract requirements, ongoing monitoring, and offboarding; advise leaders on critical vendor concentration and fourth-party dependencies.
• Manage engagement economics, including budget-to-actuals, contract terms, burn rates, staffing mix, change requests, and margin.
• Design delivery approaches, determine which testing, documentation, vendor assessment, and reporting work is delivered through the Service Delivery Center, and set requirements, quality standards, and acceptance criteria.
• Review and approve deliverables to ensure they meet EY quality, risk management, and working paper documentation standards.
• Address difficult conversations with team members and clients professionally and promptly.
• Shape offerings, methodologies, and accelerators in internal controls, internal audit, ERM, third-party risk, compliance, and resilience, including AI-enabled testing, controls monitoring, and managed-service third-party risk assessments; contribute to thought leadership.
• Delegate, supervise, and review work performed by multiple Staff and Seniors, and provide timely feedback and career advice.
• Serve as a formal counselor to Staff and Seniors, including coaching and participating in the firm-wide performance review process.
• Recruit, interview, and onboard talent.
• Identify, shape, and qualify opportunities with existing and new clients, including opportunities arising from audit results, oversight findings, vendor incidents, or new mission requirements.
• Lead proposal and oral-presentation development with Senior Managers and Partners, including solution design, staffing models, pricing inputs, and win themes.
• Build account knowledge, including client mission priorities, audit and risk posture, budget cycles, contract vehicles, and upcoming needs.

Benefits

• Medical coverage
• Dental coverage
• Pension plans
• 401(k) plans
• Flexible vacation policy
• Paid EY holidays
• Winter and summer breaks
• Personal and family care time off
• Other leaves of absence to support physical, financial, and emotional well-being

What This Job Offers

• Job Type: Full-time
• Career Level: Manager