Principal Associate, Cyber Security

Capital One • McLean, VA

5d • $161,800 - $184,600

About The Position

Capital One’s Information Security specialists focus on security, risk assessment, and resolving complex information security issues related to third parties. The Cyber Third Party Risk Reduction (CTPRR) program defines the framework and conducts assessments that help the business protect sensitive information and assets, and confirm third parties’ ability to provide continual services.

In this role, you will work with internal and external stakeholders to ensure third-party engagements receive the necessary CTPRR due diligence. You will evaluate the effectiveness of third parties’ security environments and deliver quality assessment reports. The position calls for a pragmatic understanding of risk and cybersecurity, sound judgment about when to involve experts or escalate issues, and a willingness to improve processes and program efficiency. The role requires 30–40% travel, which may include off-site locations for multi-day assessments.

Requirements

• Bachelor’s degree.
• At least 3 years of experience in cybersecurity or information technology.
• At least 2 years of experience evaluating, contributing to, or supporting the development of cybersecurity capabilities.

Nice To Haves

• 3+ years of experience with cybersecurity frameworks and concepts such as NIST CSF, MITRE ATT&CK, CMMC, or FedRAMP.
• 3+ years of experience analyzing or developing solutions for cyber threats, vulnerabilities, risks, or events.
• 3+ years of experience working on teams and presenting cybersecurity information—such as metrics, threat intelligence, controls, or requirements—to stakeholders.
• 2+ years of experience in PCI DSS, NIST, ISO, SOC 2, or third-party risk management.
• 2+ years of experience working in multi-cloud environments.
• 2+ years of experience using security tools such as Splunk, CrowdStrike, Qualys, or AWS Security Hub.
• 1+ years of experience developing or interpreting cybersecurity metrics or dashboards.
• Demonstrated familiarity with industry governance or financial governance processes.
• Experience with risk management concepts, including identifying threats, assessing vulnerabilities, and recommending mitigation strategies.
• Ability to perform security incident analysis and assist with resolution, translating technical findings into clear, actionable reports for technical and non-technical stakeholders.

Responsibilities

• Support kickoff, planning, and scoping for cyber-focused risk assessments, working with cross-functional resources to understand the operational and technical aspects of third-party service models.
• Analyze third-party control-environment data against Capital One security expectations and interpret information security requirements for specific situations.
• Review and support the execution and delivery of assessment reports, including executive summaries and work papers detailing work completed, evidence reviewed, and identified gaps.
• Maintain relationships with third-party management and Enterprise colleagues to manage expectations for assessments, remediation, timing, and deliverables.
• Work autonomously to assess needs, identify insights, and move actions forward with stakeholders.
• Stay current with industry trends and best practices through external organizations, bringing recommendations back to the team and supporting program development.
• Travel 30–40%, potentially to off-site locations for multi-day assessments.

Benefits

• Comprehensive health, financial, and other benefits supporting total well-being.
• Eligible for performance-based incentive compensation, which may include cash bonuses and/or long-term incentives.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior