Senior Cybersecurity, Privacy & Resilience Assessment Lead (Ref #: 1121346)

Estrada Consultingorporated•Nantucket, MA

1d•Hybrid

About The Position

Estrada Consulting, Inc. is seeking a Senior Cybersecurity, Privacy & Resilience Assessment Lead to perform an independent cybersecurity risk and organizational resilience assessment for a municipal government technology environment. The consultant will lead an evidence-based assessment aligned with NIST Cybersecurity Framework (CSF) 2.0 or equivalent recognized standards, evaluating cybersecurity governance, technical controls, privacy obligations, incident response, business continuity, and disaster recovery. The role will identify risks and control gaps and develop practical remediation recommendations supporting enterprise-wide technology governance and strategic planning. The position is primarily remote, with required onsite assessment visits to Nantucket Island, Massachusetts. Candidates must be available for two separate onsite periods of approximately two weeks each, anticipated during project Weeks 3–4 and Weeks 9–11; exact schedules will be coordinated with the project team. Candidates are not required to reside on Nantucket. The project is approximately 120 days, anticipated January–May 2027.

Requirements

Demonstrated experience conducting enterprise cybersecurity risk assessments and security control reviews.
Strong working knowledge of NIST CSF, cybersecurity governance, risk management, and security assessment methodologies.
Experience evaluating identity management, vulnerability management, incident response, business continuity, and disaster recovery.
Ability to assess security policies, technical controls, and organizational cybersecurity practices.
Experience documenting cybersecurity findings, risk registers, remediation recommendations, and executive reports.
Strong analytical, interviewing, technical writing, and stakeholder communication skills.
Ability to translate technical cybersecurity risks into practical recommendations for organizational leadership.
Availability for required onsite work in Nantucket, Massachusetts, including two separate onsite periods of approximately two weeks each.

Nice To Haves

CISSP, CISA, CISM, or comparable cybersecurity certification.
Experience conducting cybersecurity assessments for municipalities, counties, public safety organizations, or other government entities.
Familiarity with CJIS, HIPAA, FERPA, and public-sector privacy and security requirements.
Experience with NIST CSF 2.0 Current and Target Profiles, ISO 27001, or COBIT.
Experience assessing cybersecurity governance across multiple departments or independently operated entities.

Responsibilities

Lead a cybersecurity risk assessment using NIST CSF 2.0, including its Govern, Identify, Protect, Detect, Respond, and Recover functions.
Evaluate cybersecurity policies, risk management practices, security governance, and accountability structures.
Assess identity and access management, multifactor authentication, privileged access, and security controls.
Review vulnerability management, patch management, logging, monitoring, and threat detection capabilities.
Evaluate incident response procedures, escalation processes, cybersecurity preparedness, and recovery capabilities.
Review backup strategies, business continuity plans, disaster recovery arrangements, and recovery dependencies.
Assess relevant data privacy and regulatory obligations, including CJIS, HIPAA, FERPA, and applicable state requirements.
Evaluate third-party and supplier cybersecurity risks, including shared technology dependencies.
Document current and target cybersecurity maturity, control gaps, risk exposure, and recommended remediation activities.
Develop a prioritized cybersecurity risk register with recommendations, estimated effort, and implementation sequencing.
Coordinate with infrastructure and applications specialists regarding technical dependencies, data protection, and AI-related security risks.
Contribute to executive-level assessment reports, governance recommendations, and the multi-year IT strategic roadmap.