Principal Associate, Cyber Security

Capital One • McLean, VA

4d

About The Position

Capital One’s Cyber Third Party Risk Reduction (CTPRR) program defines a framework and conducts assessments to help protect sensitive information and assets and confirm that third parties can provide continual services. The Principal Associate, Cyber Security partners with internal and external stakeholders to ensure third-party engagements receive the required due diligence, assess the effectiveness of third-party security environments, and deliver quality assessment reports. The role calls for a practical approach to cybersecurity risk, sound judgment about when to involve experts or escalate, and a willingness to innovate and improve program efficiency. Travel of 30–40% is expected and may include multi-day assessments at off-site locations.

Requirements

• Bachelor’s degree.
• At least 3 years of experience in cybersecurity or information technology.
• At least 2 years of experience evaluating, contributing to, or supporting the development of cybersecurity capabilities.

Nice To Haves

• 3+ years of experience with cybersecurity frameworks and concepts such as NIST CSF, MITRE ATT&CK, CMMC, or FedRAMP.
• 3+ years of experience analyzing or developing solutions for cyber threats, vulnerabilities, risks, or events.
• 3+ years of experience working on teams and presenting cybersecurity information to stakeholders, such as metrics, threat intelligence, controls, or requirements.
• 2+ years of experience in PCI DSS, NIST, ISO, SOC 2, or third-party risk management.
• 2+ years of experience working in multi-cloud environments.
• 2+ years of experience using security tools such as Splunk, Crowdstrike, Qualys, or AWS Security Hub.
• 1+ years of experience developing or interpreting cybersecurity metrics or dashboards.
• Demonstrated familiarity with industry governance or financial governance processes.
• Experience with risk management concepts, including identifying threats, assessing vulnerabilities, and recommending mitigation strategies.
• Ability to perform security incident analysis and assist with resolution, translating technical findings into clear, actionable reports for technical and non-technical stakeholders.

Responsibilities

• Support kick-off, planning, and scoping of cyber-focused risk assessments, working with cross-functional resources to understand the operational and technical aspects of third-party service models.
• Analyze third-party control-environment data against Capital One security expectations and interpret information security requirements for specific situations.
• Review and support the execution and delivery of reports, including executive summaries and work papers documenting assessment work, evidence reviewed, and identified gaps.
• Maintain relationships with third-party management and Enterprise colleagues to manage expectations about assessments, remediation, timing, and deliverables.
• Work autonomously to assess needs, identify insights, and drive actions forward with stakeholders.
• Stay current with industry trends and best practices through participation in external organizations, bringing recommendations back to the team and supporting program development.
• Travel 30–40%, potentially to off-site locations for multi-day assessments.

Benefits

• Comprehensive health, financial, and other benefits supporting total well-being; eligibility varies based on employment status and management level.
• Eligible for performance-based incentive compensation, which may include cash bonuses and/or long-term incentives.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior