DirectJobHub
Jobs · Legal · Virginia

Government and Infrastructure - Cybersecurity Risk Senior

EY · Richmond, VA · 4 days ago
Legal$93k–$154k/yrFull-time

About the role

EY Government & Public Sector (GPS) is seeking a detail-oriented, experienced professional to support the implementation, documentation, and self-assessment of security controls in accordance with the NIST Risk Management Framework (RMF). The role involves guiding systems through the full RMF lifecycle:

  • Categorize: Define system criticality and authorization type required
  • Select: Determine applicable controls to meet and leverage (e.g., inheritance from cloud or other provider, enterprise services)
  • Implement: Develop security architecture, system security plan (SSP), and implement required cybersecurity controls
  • Assess: Conduct self-security assessment, collect artifacts and input package (Assessment Report and artifacts)
  • Authorize: Support Authorizing Official review and approval of package
  • Monitor: Mitigate findings from assessment, update package based on system changes, conduct operational cybersecurity tasks, and support continuous authorization

Required frameworks and guidance include NIST SP 800-37 Rev. 2, 800-53A Rev. 5, 800-30 Rev. 5, 800-60, 800-59, 800-23, 800-47, 800-34 Rev. 5, 800-84, FIPS 199, 200, and 191.

Responsibilities

  • Provide cybersecurity troubleshooting, analysis, and technical expertise; oversee work of junior team members
  • Assist in coordination of large-scale cybersecurity engagements
  • Assess cybersecurity controls, programs, and strategies using proprietary and industry frameworks
  • Operate SRC&R solutions based on engagement-defined policies and procedures
  • Review cybersecurity measurements and monitor development and operations
  • Assist in development of cybersecurity strategies and roadmap development
  • Support NIST RMF and Assessment & Authorization enhancement, operations, and governance
  • Perform cybersecurity-focused Supply Chain Risk Management and/or Third-Party Risk Management operations, assessment, and enablement
  • Design and re-engineer cybersecurity processes
  • Monitor progress, manage risk, and keep stakeholders informed about progress and expected outcomes
  • Leverage knowledge of industry trends to identify engagement and client service issues; communicate via written correspondence and verbal presentations
  • Support and manage GPS SRC&R consultants in the service delivery center
  • Develop and review reports and presentations for technical and executive audiences
  • Provide mentorship and coaching to grow staff technical and consulting skills
  • Work closely with engagement manager to co-lead and own multiple parts of engagement delivery
  • Deliver quality client services; drive high-quality work products within expected timeframes and on budget

Requirements

  • Bachelor's degree in a related field
  • 3+ years of related work experience
  • Ability to obtain and maintain a Secret-level clearance or higher
  • Working knowledge of security frameworks and standards: NIST 800-37, NIST 800-53, FIPS 199, FIPS 200, NIST CSF, NIST 800-161, CMMC, and cybersecurity laws/regulations such as FISMA
  • Experience in one or more of the following areas:
    • Cybersecurity assessments
    • IT and cybersecurity policies, standards, procedures, and controls
    • Cybersecurity strategies and roadmaps
    • Cybersecurity awareness and training
    • Cybersecurity metrics and reporting
    • Cybersecurity organization design and implementation
    • Cybersecurity and risk management solution design and implementation (e.g., SNOW IRM, Archer GRC, RiskLens, Azure Security Center)
    • Federal RMF solution operations (e.g., eMass CSAM, Xacta)
    • Cybersecurity and IT architecture experience (e.g., cloud security architect, security architect)
  • Demonstrated forward-thinking, self-motivated approach with ability to adapt and learn new knowledge
  • Strong analytical and problem-solving skills
  • Strong presentation and communication skills
  • Ability to work collaboratively in a team environment

Preferred qualifications

  • Consulting experience or experience working on technical projects

What we look for

Intellectually curious people with a genuine passion for cybersecurity who can speak up with innovative ideas, demonstrate confidence in both presentation and technical abilities, and grow into leading experts.

Benefits & compensation

Base salary ranges by office location:

  • New York City, Boston, Washington DC Metro Areas, Washington State, and Southern California offices: $92,900 – $153,900
  • Bay Area California offices: $96,000 – $160,500
  • All other US office locations (including Sacramento): $77,500 – $140,900

Individual salaries are determined by factors including education, experience, knowledge, skills, and geography. Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options. Flexible vacation policy allows you to decide how much vacation time you need based on personal circumstances. Additional time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence to support physical, financial, and emotional well-being.

Travel requirements

Work may be required at client, EY, and/or contractor sites. Professionals are assigned to projects within a commutable distance of their work location office. Travel of 20–30% or more may be required based on client and project needs.

Similar jobs