Cybersecurity Assessor

Assess enterprise security programs through risk and compliance evaluations, translating findings into remediation actions.

Responsibilities

• Conduct security and compliance assessments across internal systems and third-party vendors to support adherence to organizational and regulatory requirements.
• Assess external service provider security practices and support lifecycle vendor risk management.
• Analyze assessment results, document findings, and support remediation by tracking issues and helping teams prioritize corrective actions.
• Partner with business and technical stakeholders to clarify compliance requirements and help resolve identified risks within accepted thresholds.
• Use risk management tools and reporting dashboards to maintain assessment documentation, track risk metrics, and contribute to security posture reporting.
• Act as a bridge between Business Analysts and Cybersecurity Engineers by translating compliance requirements into actionable remediation tasks while maintaining organizational risk thresholds.
• Centralize assessment documentation and streamline workflows using GRC platforms (e.g., Archer, ServiceNow) and Third-Party Risk tools (e.g., OneTrust, Prevalent).
• Convert complex assessment findings into actionable insights using Power BI and Excel, maintaining dashboards for enterprise security posture communication.
• Perform daily RMF lifecycle control assessments, including evidence collection, walkthroughs, testing of technical and administrative controls, and POA&M tracking to keep risk within tolerance.
• Apply expertise in GRC methodologies, security control auditing, and third-party risk assessments.

Requirements

• 5+ years of relevant experience.
• Expertise in GRC methodologies, security control auditing, and third-party risk assessments.
• Proven ability to interpret federal compliance mandates and evaluate technical and administrative controls, including NIST SP 800-53 and NIST SP 800-37.
• Strong competency in conducting Security Impact Analyses and managing Plan of Action and Milestones (POA&M) documentation.
• Experience running security and compliance assessments across internal systems and third-party vendors.
• Experience evaluating external service provider security practices and supporting vendor risk management across the assessment lifecycle.
• Experience analyzing assessment results, documenting findings, and supporting remediation by tracking issues and prioritizing corrective actions.
• Experience working with business and technical stakeholders to clarify compliance requirements and resolve risks within accepted thresholds.
• Experience using risk management tools and reporting dashboards to maintain assessment documentation, track risk metrics, and support security posture reporting.
• Experience translating compliance requirements into actionable remediation tasks while maintaining organizational risk thresholds.
• Experience supporting daily RMF lifecycle control assessments, including evidence collection, walkthroughs, testing of technical and administrative controls, and POA&M tracking.

Tools & Technologies

• GRC Platforms: Archer, ServiceNow
• Third-Party Risk Tools: OneTrust, Prevalent
• Analytics & Documentation: MS Excel (Advanced), MS Power BI, MS Visio
• Tracking & Productivity: JIRA, Microsoft Office Suite
• Frameworks/Standards: NIST SP 800-53, NIST SP 800-37

Certifications

• CISA
• CRISC
• CGEIT
• CISSP
• CompTIA Security+
• CCSK
• CAP/ISC2 CGRC

Location & Compensation

• Location: Brooklyn, NY (onsite)
• Salary: USD 125,000 - 130,000 per year