Third-Party Cyber Risk Management - Engineer II

GEICO•Bethesda, MD

1d•$60,000 - $215,000

About The Position

GEICO’s Cybersecurity organization has an exciting opportunity for an accomplished Engineer II – Third-Party Cyber Risk Management. This individual will play a key role within GEICO’s Trustworthy Engineering organization, on the Third-Party Cyber Risk Management (TPCRM) team, with a focus on executing the day-to-day third-party inventory, assessment, reassessment, and data-sharing risk work that supports GEICO’s third-party cyber risk program. Our Engineer II – Third-Party Cyber Risk Management is responsible for assisting the TPCRM team’s efforts to inventory GEICO’s third-party ecosystem, execute risk-based security assessments and reassessments, and enforce secure data-sharing practices for third parties that access GEICO data. This includes maintaining and reconciling third-party records in industry-recognized risk assessment tools and related systems, working through the current backlog of third parties missing a required security assessment, supporting the team’s quarterly commitment to complete all reassessments due, and helping monitor the effectiveness of implemented controls, under the guidance of senior engineers on the team.

Requirements

Experience conducting risk or security assessments, or supporting reassessment/renewal processes, in a cybersecurity, IT risk, or vendor/third-party risk context
Experience working with GRC, TPCRM, or workflow platforms (e.g., industry-recognized risk assessment tools, Archer, ServiceNow) to execute or track assessments, issues, or records
Experience reconciling data across multiple systems and identifying/resolving data-quality gaps
Working knowledge of cybersecurity and data-privacy regulations and standards relevant to third-party risk (e.g., NYDFS, NIST CSF)
Familiarity with data security and third-party risk frameworks and protocols, such as ISO 27001, NIST, and CIS
Strong analytical and problem-solving skills, with the ability to execute well-defined tasks reliably and escalate ambiguous issues to senior engineers
Strong written and verbal communication skills, with the ability to build working relationships with teammates and cross-functional stakeholders such as Supplier Management and Legal
A proactive, detail-oriented approach to high-volume, deadline-driven work, along with a willingness to seek mentorship and feedback to grow technical and domain expertise

Nice To Haves

One or more of the following cybersecurity certifications are highly desired: CompTIA Security+ (Sec+), CompTIA Cybersecurity Analyst+ (CYSA+)
One or more of the following cybersecurity certifications are highly encouraged: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Third-Party Risk Professional (CTPRP)
Experience with GRC/TPCRM or workflow platforms (e.g., OneTrust, Archer, ServiceNow), or comparable ticketing/case-management tools, preferred
Experience with data reconciliation, reporting, or dashboarding tools (e.g., Excel, Power BI, SQL) preferred
Familiarity with cloud environments (AWS, GCP, or Azure) a plus

Responsibilities

Execute third-party security assessments and reassessments in industry-recognized tools, following defined standards for accuracy, completeness, and timeliness, with minimal guidance from senior engineers
Prioritize and work through the inventory of third parties identified as missing a required TPCRM security assessment, helping the team reach 100% completion of outstanding reviews
Implement defined industry-recognized risk assessment tools configuration items, including inventory attributes, assessment workflow steps, and reporting fields, in support of the broader TPCRM architecture set by senior engineers
Reconcile third-party records across industry-recognized risk assessment tools and other enterprise systems to identify and close data gaps, and validate that data is shared with third parties using approved, secure data-sharing methods
Support centralized tracking of third-party security issues by maintaining issue records, monitoring remediation status against SLAs, and escalating gaps to senior team members as needed
Interest or experience in applying AI/automation (e.g., AI-assisted data classification, decisioning logic, or reporting) to streamline TPCRM workflows such as intake routing, low-risk auto-approvals, and dashboard generation, reducing manual effort across the assessment and reassessment process
Contribute to quarterly and executive-level reporting on assessment, reassessment, and issue-management metrics, helping ensure the underlying data is accurate and current
Collaborate with Supplier Management, Legal, Data Protection Engineering, and business stakeholders to gather the information needed to complete assessments and close third-party data-sharing gaps
Continuously build proficiency with industry-recognized risk assessment tools, third-party risk frameworks, and the team’s assessment methodologies, and seek out mentorship from senior engineers to grow technical and domain expertise
Conduct root-cause analysis on data-quality issues or defects in third-party records and assessment workflows, and implement fixes under senior engineer guidance
Support the team’s roadmap by helping execute the underlying inventory, assessment, and reassessment work that feeds more advanced capabilities such as risk-based intake and continuous risk assessment
Actively seek and apply feedback from teammates and senior engineers, share knowledge with the team, and help teammates work through obstacles and blockers when asked