Senior Cybersecurity Analyst

Amentum•Richmond, VA

3d•$110,000 - $130,000•Remote

About The Position

The Senior Cybersecurity Risk Analyst is a senior individual contributor on Amentum’s Cybersecurity Governance, Risk, and Compliance (GR&C) team. This US-remote role owns enterprise cyber risk assessment work, evaluating activities and operational decisions and explaining the resulting risks to business leadership in relation to the enterprise’s risk appetite. It focuses on identifying risks that compliance-driven reviews may not uncover, then supporting informed decisions to accept, mitigate, or remediate them. The role partners with the Compliance function to promote cohesive cyber risk management across frameworks and the enterprise. The analyst helps protect Amentum from internal and external cyber threats and contributes recommendations to improve the enterprise security program in line with industry best practices, regulations, policies, standards, and guidelines. The position requires sufficient technical depth to assess networking, cloud, endpoint, identity, and access decisions, along with the credibility to communicate risk to engineering, IT, and leadership. The role represents the enterprise rather than a single team, contract, or project, and is intended to surface risk without hindering business operations. It is a US remote telework position, requires US citizenship and residence in the United States, and involves travel up to 25 percent.

Requirements

Typically 8 years of hands-on cybersecurity experience and a bachelor’s degree in Computer Science, Information Systems, or a related field, or 4 years of experience with a master’s degree.
Demonstrated depth evaluating real technology environments; policy or audit administration alone is not sufficient.
Demonstrated experience in enterprise risk management and third-party or vendor cyber risk assessment.
Current Security+ certification or an equivalent industry certification.
U.S. citizenship.
Must reside within the United States to work remotely.
Ability to independently recognize and assess cyber risk in networking, cloud, endpoint, and identity and access management technologies and decisions.
Ability to communicate cyber risk to business leadership in decision-ready terms.
Working knowledge of NIST publications and their relevance to cyber risk and compliance.
Strong written and verbal communication skills, including explaining technical risk to non-technical stakeholders.
Self-starter able to work autonomously on ambiguous problems with limited direction.
Ability to travel up to 25 percent.

Nice To Haves

Senior certifications such as CISSP or CySA+, and an identity and access credential such as Microsoft SC-300.
Hands-on experience in Microsoft Azure, including Microsoft 365; Azure Government (GCC High) exposure is strongly preferred.
Direct experience assessing identity and access architectures, including Entra ID, B2B and external identity, conditional access, and privileged access.
Experience in U.S. Federal or Defense Industrial Base environments and familiarity with CMMC, NIST SP 800-171/172, DFARS, UK Cyber Essentials, Australian Essential Eight, UK GDPR, and EU NIS2 from a risk perspective.
Familiarity with multi-framework risk management, including ISO/IEC 27001 and crosswalk approaches for cohesive risk treatment.
Experience improving GR&C operational processes, including assessment methodology, intake, and risk reporting.
Bachelor’s degree in a related field; a degree is not required, and equivalent experience is acceptable.

Responsibilities

Conduct enterprise cyber risk assessments of activities and operational decisions, identifying risks to the confidentiality, integrity, and availability of systems and data.
Communicate cyber risk to business and technical leadership in clear, decision-ready terms and in relation to the enterprise’s risk appetite.
Lead cyber risk reviews, including third-party cyber risk assessments, temporary risk acceptance reviews, and software risk reviews; track enterprise artificial intelligence development as it relates to cyber risk.
Coordinate with Compliance so mandatory control interpretations do not leave other cyber risks unaddressed and risk treatment remains coherent across frameworks.
Evaluate cyber risk implications of technology decisions involving networking, cloud, endpoint, and identity and access architectures.
Identify when residual cyber risk exceeds enterprise appetite and specify the risk reduction required.
Contribute a risk-posture perspective to enterprise scoping and architecture decisions, including residual risk from carved-out certification environments and enclave boundaries.
Improve Cyber GR&C operational and procedural practices, including assessment methodology, intake, risk articulation standards, evidence handling, and consistency of team judgments.
Maintain current knowledge of cyber risk, threats, technology, and regulations and apply it to assessments and team capability.
Travel up to 25 percent and perform other position-related duties as assigned.