Senior Cyber Risk Management Engineer

White Cap • Atlanta, GA

3d • Onsite

About The Position

Responsible for providing expertise in implementing and maintaining cybersecurity risk frameworks, including NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and NIST RMF (National Institute of Standards and Technology Risk Management Framework). Assess, review, and help identify areas where security controls do not exist currently.

Requirements

• 5+ years of cybersecurity experience conducting risk assessments, identifying security gaps, and recommending mitigation strategies.
• Strong analytical and problem-solving skills, with the ability to communicate complex technical issues to senior IT leaders and non-technical stakeholders.
• Experience with identity and access management (IAM), identity governance and administration (IGA), and Privileged Access Management (PAM) processes and platforms.
• Knowledge of access governance, least-privilege principles, privileged account lifecycle management, access reviews, role-based access control, and security exception management.
• Hands-on experience conducting information security assessments, application control self-assessments (SC1/SC2), control testing, and remediation tracking.
• In-depth knowledge of NIST Cybersecurity Framework (CSF) and Risk Management Framework (RMF), with a strong ability to apply these frameworks to organizational security practices.
• In-depth knowledge of operating systems and security baselines, including CIS Controls and CIS Benchmarks, with experience assessing technology configurations and documenting control gaps.
• Experience administering Risk and Control Self-Assessments (RCSAs), maintaining risk and control documentation, validating evidence, and coordinating with risk and control owners.
• Ability to collect, validate, reconcile, and analyze security data; develop key risk indicators and operational metrics; and investigate missing, incomplete, or inconsistent information.
• Experience producing security dashboards, program reporting, trend analysis, and concise executive-level presentations for monthly leadership reviews.
• Strong written, verbal, and stakeholder-management skills, with the ability to communicate control issues clearly to business, technology, security, and leadership audiences.

Nice To Haves

• Preferred certifications: CRISC (ISACA), CGRC ((ISC)²), CISSP ((ISC)²), or comparable governance, risk, access management, or information security certifications.

Responsibilities

• Conduct thorough and regular risk assessments to identify and evaluate potential threats and vulnerabilities related to critical infrastructure.
• Develop and maintain cyber risk-based statements and scenarios to enhance risk register capabilities.
• Identify, track, and report on Cyber Key Risk Indicators.
• Collaborate with cross-functional teams to ensure the integration of security measures into organizational processes and systems.
• Stay updated on emerging cyber threats and industry best practices to enhance risk mitigation strategies.
• Conduct threat intelligence monitoring and reporting as needed.
• Lead the implementation of comprehensive cyber risk management strategies and risk monitoring.
• Perform annual assessments of operating system security baselines.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior