Identity Risk Analyst

About the Role

Analyze documents and conduct intake and elicitation sessions with project teams. Decompose applications or services into the analytical components required for impact assessment. Conduct initial impact assessments and document the chain of reasoning supporting each determination. Document each application or service's impact assessment, assurance level selections, and any tailoring decisions. Re-engage with project teams when service scope, user populations, transaction types, or threat conditions change in ways that affect prior risk and determination. Produce analytical written products — risk assessments, impact assessments, security plan sections, control assessment reports, or equivalent. Applying a normative framework (NIST SP 800-63, 800-30, 800-37, or equivalent) to a specific service and producing a written analysis that shows the judgments made at each step.

Required Skills

• Working knowledge of NIST SP 800-63-4, especially the base volume, and the NIST Risk Management Framework (SP 800-37)
• Working knowledge of NIST SP 800-63-4, fraud prevention, identity verification, risk analysis, cybersecurity, financial crime, or a related field
• Experience in fraud prevention, identity verification, risk analysis, cybersecurity, financial crime, or a related field
• Direct experience conducting digital identity risk assessments under NIST SP 800-63 (Revision 3 or 4) for production online services

Qualifications

• Education & Experience: Master's and 5+ years of experience, Bachelor's and 7+ years of experience, or 13+ years in lieu of a degree
• Bachelor's or higher degree in Computer Science, Information Systems, Cybersecurity, Mathematics, Statistics, Philosophy, Law, Economics, or a related analytical discipline
• Selected candidate must be able to obtain and maintain a public trust clearance
• Selected candidate must be willing to work on-site in Woodlawn, MD 5 days a week

Analytical Competencies

• Analytical decomposition: Reliably breaks complex systems into the components required for the analysis
• Rubric application: Applies a written rating rubric to a specific case by identifying the rubric row that matches the case and recording the corresponding rating. Does not substitute personal judgment for the rubric where the rubric is determinative
• Categorical reasoning: Can determine whether an impact category applies to a given situation before rating its severity
• Source-and-direction tracking: Distinguishes information the system holds about a user from information the user provided to the system
• Elicitation: Obtains required information from stakeholders, particularly when the information initially received is incomplete or conflicting
• Written precision: Produces clear analytical prose. Reasoning is traceable. Conclusions are tied to evidence
• Critical thinking: Evaluates information and arguments for soundness, identifies unstated assumptions, and distinguishes claims that are supported from those that are not
• Self-direction: Manages a queue of assessments without daily supervision and surfaces blockers early

Desired Skills

• Professional certifications: CISSP, CISA, CIPP/G, or equivalent would be a plus
• Strong attention to detail and organizational skills
• Proficiency with Microsoft Excel and standard business applications
• Ability to manage multiple priorities in a fast-paced environment while maintaining accuracy

Benefits

• Comprehensive medical, dental, vision, life, and short & long-term disability insurance + health savings account
• Matching 401k retirement plan + IRA's and Roth IRA's
• Generous paid time off and paid holidays
• Employee recruitment/referral bonus
• Paid community service hours
• Tuition reimbursement
• Employee discounts