Cyber Risk Management Analyst

The Cyber Risk Management Analyst will support identification, communication, and distribution of cybersecurity risks and actionable mitigations or remediations at the tactical and strategic levels within the agency's information technology environment.

• Assist the Government in identifying tactical risks through working with the operational teams such as the VAT, SOC, CTI, along with other applicable teams and data to create a full picture of the tactical cyber risks. 
• Assist the Government in conducting reviews and recommendations for approvals of tactical level change requests.
• Assist the Government with the prioritization of vulnerability remediation. 
• Support the identification of common gaps in the information system security using methods such as the MITRE ATT&CK framework to focus recommendations to Government regarding holistic funding in support of remediating security gaps for multiple systems.
• Support the identification of strategic risks through working with the Security Control Assessors (SCAs), Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), system owners, and other applicable teams to gather data for the creation of a full picture of the strategic cyber risks. 
• Support the Risk Assessment (RA) Initiative by conducting Risk Assessments for agency systems by gathering data on security incidents, vulnerabilities, Plan of Actions & Milestones (POA&Ms), Known Exploited Vulnerabilities (KEVs), Loss Magnitude Metrics, Threat Actors, and TTPs.
• Assist the Government in developing and maintaining a risk tolerance level through working with senior management to formally establish the level of acceptable risk.
• Assist the Government in developing information system risk profiles in alignment with the NIST Cybersecurity Framework. 
• • Assist the Government in conducting reviews and recommendations to aid the Government in approving risk acceptance memoranda, assist with the prioritization of POA&Ms, create risk profiles for all information systems, and identify common gaps in the information system compliance to focus holistic funding in support of remediating security findings for multiple systems.
• Assist the Government in creating a holistic picture of the cyber risks and effectively communicate the risks to the applicable stakeholders and senior management.
• Assist the Government in providing briefings for senior management on the cyber risk posture of the agency.
• Assist the Government in historical tracking and reporting of current trends on cybersecurity events and incidents, including but not limited to phishing, malware, and scanning / probing activity to develop probabilities for future occurrences.
• Assist with creating and reviewing documentation and processes concerning Cybersecurity Supply Chain Risk Management (C-SCRM).

• Bachelor’s Degree in Computer Science or a related field or equivalent experience.
• Minimum 5 years of information security experience, to include experience related to cyber security risk management.
• US Citizenship / no dual

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age. All decisions on employment are made to abide by the principle of equal employment.

Physical Requirements

The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties' or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.

• Strong understanding of IT cyber security tools, hardware/software security implementation, and communication protocols.
• Familiarity with MITRE ATT&CK framework.
• Strong written and verbal communication skills.

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.