Senior Cybersecurity Risk Analyst

Amentum•Richmond, VA

8d•Remote

About The Position

The Senior Cybersecurity Risk Analyst is a senior individual-contributor role on Amentum’s Cybersecurity Governance, Risk, and Compliance (GR&C) team. This US-remote position owns enterprise cyber risk assessments by evaluating activities and operational decisions, then communicating resulting risks to business leadership in decision-ready terms and against the enterprise’s risk appetite. The role focuses on risks that compliance-driven reviews alone may not identify and works alongside the Compliance function to support coherent cyber risk management across frameworks. The analyst evaluates technology and operational decisions involving networking, cloud, endpoint, and identity and access architectures. The role leads varied cyber risk reviews, including third-party assessments, temporary risk acceptance reviews, and software risk reviews, and tracks enterprise artificial intelligence development as it relates to cyber risk. It also contributes risk perspectives to enterprise scoping and architecture decisions, helps identify when residual risk exceeds the enterprise’s appetite, and recommends required risk reduction. The position contributes to improving GR&C assessment methodology, intake, risk articulation standards, evidence handling, and consistency of risk judgments. It requires current knowledge of cyber risk, threats, technology, and regulations. This is a US remote telework position requiring US citizenship and residence in the United States. Travel is up to 25 percent.

Requirements

Typically 8 years of hands-on cybersecurity experience with a bachelor’s degree in Computer Science, Information Systems, or a related field, or 4 years of experience with a master’s degree.
Demonstrated depth evaluating real technology environments; experience solely in policy or audit administration is not sufficient.
Demonstrated experience in enterprise risk management and third-party or vendor cyber risk assessment.
Current Security+ certification or an equivalent industry certification.
U.S. citizenship.
Must reside within the United States to work remotely.
Ability to recognize cyber risk in networking, cloud, endpoint, and identity and access management well enough to independently assess engineering and IT decisions.
Ability to communicate cyber risk to business leadership in decision-ready terms and explain technical risk to non-technical stakeholders.
Working knowledge of NIST publications and their relevance to cyber risk and compliance.
Strong written and verbal communication skills.
Ability to operate autonomously as a self-starter on ambiguous problems with limited direction.
Ability to travel up to 25 percent.

Nice To Haves

Senior certifications such as CISSP or CySA+, and an identity and access credential such as Microsoft SC-300.
Hands-on experience in Microsoft Azure, including Microsoft 365; exposure to Azure Government (GCC High) is strongly preferred.
Direct experience assessing identity and access architectures, including Entra ID, B2B and external identity, conditional access, and privileged access.
Experience in U.S. Federal or Defense Industrial Base environments.
Risk-perspective familiarity with CMMC, NIST SP 800-171/172, DFARS, UK Cyber Essentials, Australian Essential Eight, UK GDPR, and EU NIS2.
Familiarity with multi-framework risk management, including ISO/IEC 27001 and crosswalk approaches for cohesive risk treatment.
Experience improving GR&C operational processes, including assessment methodology, intake, and risk reporting.
Bachelor’s degree in a related field; a degree is not required, and equivalent experience is acceptable.

Responsibilities

Conduct enterprise cyber risk assessments of activities and operational decisions, identifying risks to the confidentiality, integrity, and availability of systems and data.
Communicate cyber risk to business and technical leadership in clear, decision-ready terms and in relation to the enterprise’s risk appetite.
Lead cyber risk reviews, including third-party cyber risk assessments, temporary risk acceptance reviews, and software risk reviews; track enterprise artificial intelligence development as it relates to cyber risk.
Work with Compliance to ensure mandatory control interpretations do not leave other cyber risks unaddressed and that risk treatment is coherent across frameworks.
Evaluate cyber risk implications of technology decisions involving networking, cloud, endpoint, and identity and access architectures.
Identify when residual cyber risk exceeds enterprise risk appetite and specify required risk reduction.
Contribute risk-posture perspectives to enterprise scoping and architecture decisions, including residual risk implications of carved-out certification environments and enclave boundaries.
Improve GR&C assessment methodology, intake, risk articulation standards, evidence handling, and consistency of team risk judgments.
Maintain current knowledge of cyber risk, threats, technology, and regulations and apply it to assessments and team capability.
Travel up to 25 percent.
Perform other position-related duties as assigned.