Senior Cybersecurity Risk Analyst

Amentum•Richmond, VA

9d•$110,000 - $130,000•Remote

About The Position

The Senior Cybersecurity Risk Analyst is a senior individual contributor on Amentum’s Cybersecurity Governance, Risk, and Compliance team. This US-remote role owns enterprise cyber risk assessment work by evaluating activities and operational decisions, identifying risks that compliance-driven reviews may not surface, and explaining those risks to business and technical leadership in decision-ready terms against the enterprise’s risk appetite. The analyst works alongside the Compliance function to support cohesive cyber risk management across frameworks and helps business and operational owners make informed decisions to accept, mitigate, or remediate risk. The role requires technical capability to assess risk in networking, cloud, endpoint, and identity and access decisions, as well as the credibility to communicate findings to engineering, IT, and leadership. It acts on behalf of the enterprise rather than a single team, contract, or project, and is intended to bring attention to risk without hindering the business. The analyst also contributes to the security program and improves Cyber GR&C assessment practices. The position is US remote telework, requires US citizenship and US residence, and involves travel up to 25 percent.

Requirements

Typically 8 years of hands-on cybersecurity experience and a bachelor’s degree in Computer Science, Information Systems, or a related field; alternatively, 4 years of experience with a master’s degree.
Demonstrated depth evaluating real technology environments; policy or audit administration alone is not sufficient.
Demonstrated enterprise risk management experience and third-party or vendor cyber risk assessment experience.
Current Security+ certification or an equivalent industry certification.
U.S. citizenship.
Must reside within the United States to work remotely.
Ability to independently recognize cyber risk in networking, cloud, endpoint, and identity and access management technologies and assess engineering and IT decisions.
Ability to articulate cyber risk to business leadership in decision-ready terms.
Working knowledge of NIST publications and their relevance to cyber risk and compliance.
Strong written and verbal communication, including explaining technical risk to non-technical stakeholders.
Ability to work autonomously as a self-starter on ambiguous problems with limited direction.
Ability to travel up to 25 percent.

Nice To Haves

Senior certifications such as CISSP or CySA+, and an identity and access credential such as Microsoft SC-300.
Hands-on experience in Microsoft Azure, including Microsoft 365; exposure to Azure Government (GCC High) is strongly preferred.
Direct experience assessing identity and access architectures, including Entra ID, B2B and external identity, conditional access, and privileged access.
Experience in U.S. Federal or Defense Industrial Base environments.
Risk-perspective familiarity with CMMC, NIST SP 800-171/172, DFARS, UK Cyber Essentials, Australian Essential Eight, UK GDPR, and EU NIS2.
Familiarity with multi-framework risk management, including ISO/IEC 27001, and crosswalk approaches for cohesive risk treatment.
Experience improving GR&C operational processes, including assessment methodology, intake, and risk reporting.
Bachelor’s degree in a related field; equivalent experience is acceptable, and a degree is not required.

Responsibilities

Conduct enterprise cyber risk assessments of activities and operational decisions, identifying risks to the confidentiality, integrity, and availability of systems and data.
Explain cyber risk to business and technical leadership in clear, decision-ready terms in relation to the enterprise’s risk appetite.
Lead cyber risk reviews, including third-party cyber risk assessments, temporary risk acceptance reviews, and software risk reviews; track enterprise artificial intelligence development as it relates to cyber risk.
Work with Compliance to ensure control interpretations do not leave other cyber risks unaddressed and that risk treatment is coherent across frameworks.
Evaluate cyber risk implications of technology decisions involving networking, cloud, endpoint, and identity and access architectures.
Identify when residual cyber risk exceeds the enterprise’s appetite and specify the risk reduction required.
Contribute a risk-posture perspective to enterprise scoping and architecture decisions, including residual risk implications of carved-out certification environments and enclave boundaries.
Improve Cyber GR&C operational and procedural practices, including assessment methodology, intake, risk articulation standards, evidence handling, and consistency of risk judgments.
Maintain current knowledge of cyber risk, threats, technology, and regulations and apply it to assessments and team capability.
Travel up to 25 percent.
Perform other position-related duties as assigned.