Nist Cybersecurity Framework

Nist Cybersecurity Framework Jobs

94 jobs found

Today

Cybersecurity Consultant

Claris Consulting Inc. Honolulu, HI

Honolulu, HI

Today

$80k - $100k/yr Full time Application Security Client Consulting Consultant

Apply Now

Job Description

Join Claris Consulting Inc. as a Cybersecurity Consultant supporting technical security assessments, offensive testing, remediation validation, and CISO/vCISO advisory work.

Responsibilities

Support technical security assessments, control reviews, vulnerability management, and remediation efforts
Review and validate security findings, vulnerabilities, system configurations, and supporting technical evidence
Research vulnerabilities, attack techniques, security controls, and practical remediation options
Track remediation progress and help validate whether identified issues are effectively resolved
Conduct internal, external, network, web application, and other penetration testing activities within approved rules of engagement
Perform reconnaissance, vulnerability validation, exploitation, privilege escalation, lateral movement, and post-exploitation testing as appropriate
Conduct onsite testing, technical validation, and evidence collection at client facilities when required
Identify realistic attack paths and explain how individual weaknesses can impact business operations
Plan and facilitate cybersecurity tabletop, red-team, purple-team, and adversary simulation exercises
Contribute technical expertise to scenarios covering attacker behavior, detection, response, containment, recovery, and business disruption
Support cybersecurity framework and control reviews, including NIST CSF, CIS Controls, and similar standards
Assist with vendor security reviews, technical documentation reviews, and third-party risk activities
Develop clear findings with supporting evidence, affected assets, risk, technical context, and practical remediation guidance
Prepare technical reports, project summaries, and executive-level updates for different audiences
Present findings and recommendations to technical teams, security leadership, and other stakeholders when needed
Coordinate with system owners, administrators, vendors, and client contacts to clarify findings and support remediation planning
Maintain organized project notes, evidence, timelines, and engagement documentation
Support CISO/vCISO advisory and cybersecurity program activities as client needs evolve
Follow established testing boundaries, data-handling requirements, and escalation procedures

Requirements

Approximately 3 to 5 years of professional experience in cybersecurity consulting, security assessments, vulnerability management, penetration testing, security operations, governance, risk, compliance, or a closely related area
Strong technical foundation across networking, operating systems, identity and access management, common enterprise services, and security controls
Hands-on experience across multiple areas such as security assessments, vulnerability management, remediation, penetration testing, control validation, incident response, or security program support
Practical experience conducting or supporting authorized penetration tests or offensive security assessments
Ability to review and interpret vulnerabilities, scanner results, logs, system configurations, network diagrams, policies, and other technical evidence
Experience evaluating security findings, determining practical risk, and developing clear remediation recommendations
Familiarity with common security tools and platforms including vulnerability scanners, SIEM solutions, endpoint security tools, firewalls, network analysis tools, and penetration testing tools
Working knowledge of Windows, Linux, and Active Directory in enterprise IT environments
Ability to independently complete substantial portions of assigned projects once objectives, scope, and expectations are established
Ability to research unfamiliar technologies, security issues, frameworks, and client environments
Strong written and verbal communication skills for documenting findings and explaining technical issues clearly
Ability to manage multiple projects, competing priorities, and changing client needs in a consulting environment
Strong judgment around sensitive information, testing boundaries, operational risk, and escalation
Self-motivated and adaptable, contributing across technical and non-technical cybersecurity projects
Must currently reside in Hawaii, be authorized to work in the United States, and be able to travel to client locations within Hawaii for onsite project activities

Technologies

NIST CSF, CIS Controls, NIST SP 800-53
ISO 27001
MITRE ATT&CK, PTES, OWASP
Windows, Linux, Active Directory
SIEM solutions, endpoint security tools, firewalls, network analysis tools, penetration testing tools
Python, PowerShell, Bash
CrowdStrike, Microsoft Defender, vulnerability management platforms

Benefits

401(k)
Dental insurance
Health insurance
Paid time off
Vision insurance
Flexible schedule
Life insurance

Location and Employment

Location: Hybrid remote in Honolulu, HI, with onsite work at client locations as required
Address: Honolulu, HI 96816 (Required)
Job type: Full-time
Salary: USD 80,000 - 100,000 per year (depending on experience and technical capabilities)

View full job page →

4d ago

Associate Cybersecurity Analyst

GM Financial Irving, TX

Irving, TX

4d ago

Full time Cloud Platforms Cybersecurity Tools Information Security

Apply Now

Job Description

GM Financial is building out its Cybersecurity Program, and this Associate Cybersecurity Analyst role supports that effort by organizing cybersecurity risk information and helping drive practical risk management decisions. Based in Irving, TX with a hybrid schedule, the position also strengthens the organization’s security posture by keeping policies current, tracking remediation, and partnering closely with business stakeholders.

What you will do

Develop and update cybersecurity policies, standards, and procedures, using NIST 800-53 controls and the NIST Cyber Security Framework as references, and implement revisions aligned to updates in relevant regulatory or industry cybersecurity practices.
Support audit management by tracking remediation items and/or findings through completion.
Collaborate with business partners to manage cybersecurity needs.
Contribute to security requirements for protecting the company from external and internal threats.
Document and report policy and procedure discrepancies, along with change requests.
Initiate, facilitate, and promote cybersecurity across the organization while monitoring adherence to cybersecurity policies, standards, and controls.
Advocate for cybersecurity as an essential business requirement and use business needs as a foundation for cybersecurity program design.
Ensure effective communication and partnership across GM Financial departments, serving as a liaison and first point of contact for cybersecurity concerns.
Represent the Global Cybersecurity organization on projects as needed.
Translate high-level business requirements into enterprise security initiatives and programs aligned to GM Financial’s mission, goals, and objectives.
Work with stakeholders and project teams to plan, design, and verify appropriate levels of security governance, resource management, and asset management.

What you bring

A high-level understanding of the financial services industry, including security, risk, and privacy.
Current knowledge and the ability to stay up-to-date on relevant cybersecurity legislation, regulations, advisories, alerts, and vulnerabilities.
Knowledge of information security and cybersecurity frameworks.
Proficiency with MS-Office applications including Word, PowerPoint, Excel, Visio, and Project.
Knowledge of security methodologies, policies, standards, and industry practices.
Knowledge of information technology systems, infrastructure, and operations.
Understanding of cloud technologies and concepts.
Familiarity with DevOps and the Agile development process.
Ability to initiate, facilitate, and promote cybersecurity and monitor adherence to policies, standards, and controls.
Ability to clearly explain and articulate technical concepts using non-technical language.
Strong analytical skills, verbal communication, and interpersonal skills.
Ability to use AI tools (for example, Microsoft Copilot) to support daily work, including evaluating AI outputs for accuracy, compliance, and bias.
Experience integrating AI into workflows to improve efficiency or insights, including familiarity with AI-assisted research, summarization, and content generation.
Understanding of responsible AI use, including ethics and data protection.
High School Diploma or equivalent required.

Technologies

NIST 800-53 controls
NIST Cyber Security Framework
MS-Office (Word, PowerPoint, Excel, Visio, Project)
Microsoft Copilot and AI tools
DevOps and Agile development process
Cloud technologies

Benefits

Generous benefits package available on day one, including 401K matching
Bonding leave for new parents: 12 weeks, 100% paid
Tuition assistance and training
GM employee auto discount
Community service pay
Nine company holidays
Competitive pay and bonus eligibility
Flexible hybrid work environment, with 4 days a week in office

Additional notes

GM Financial is unable to consider candidates who require visa sponsorship for this position.
This position is not open to agency submissions.

View full job page →

9d ago

Principal Classified Cybersecurity Analyst

Northrop Grumman Baltimore, MD

Baltimore, MD

9d ago

$109k - $163k/yr Full time Senior Analyst Cybersecurity Tools

Apply Now

Job Description

On-site role in Baltimore, MD for a Principal Classified Cybersecurity Analyst with Northrop Grumman, focused on information systems lifecycle security, audits, compliance, and A&A/ST&E activities.

Responsibilities

Conduct system audits and continuous monitoring across security controls, configurations, and operational processes to evaluate the information systems security posture.
Assess systems and networks within the enclave to identify deviations from approved configurations, enclave policy, or local policy.
Analyze to validate established security requirements and recommend additional safeguards and controls.
Assist in implementing required government policy, advise on process tailoring, and participate in and document process activities.
Establish rigorous program control processes to mitigate risks and support the Assessment and Authorization (A&A) of systems, including process support, coordination, security certification testing, documentation, investigations, hardware/software introduction and release, emerging technology research, inspections, and periodic audits.
Support the formal Security Test and Evaluation (ST&E) required by each government accrediting authority through pre-test preparations, test participation, analysis of results, and reporting.
Document A&A results and related technical or coordination activities, building the Risk Management Framework body of evidence.

Requirements

Master’s degree with 3 years of experience, Bachelor’s degree with 5 years, Associate degree with 7 years, or High School Diploma/GED with 9 years of experience in lieu of a degree.
Must meet U.S. Government 8140 requirements for Principal Cybersecurity Analyst – Security+.
Current U.S. Government Top Secret clearance (minimum), with a closed investigation date within the last 6 years, or enrolled in the Continuous Evaluation (CE) program to be considered.
Ability to obtain and maintain access to Special Access Programs as a condition of employment.

Technologies

ACAS
Nessus
Splunk
Trellix
SCAP
NIST
JSIG
DAAG
SSPs
POA&Ms
SCTMs

Benefits

Flexible work arrangements
Phenomenal learning opportunities
Exposure to a wide variety of projects and customers
Friendly team environment
Exceptional benefits and healthcare
9/80 work schedule
Strong 401(k) matching program

Relocation Assistance

Relocation assistance may be available

Travel

Travel required up to 10 percent of the time

Preferred Qualifications

Bachelor’s degree in Cybersecurity or a related field
Experience with cybersecurity compliance, including RMF A&A
Knowledge of security tools such as ACAS, Nessus, Splunk, Trellix, and SCAP
Familiarity with security frameworks and documentation such as NIST, JSIG, DAAG, SSPs, POA&Ms, and SCTMs

Salary

Primary level salary range: $108,800.00 - $163,200.00 per year

View full job page →

9d ago

Cybersecurity Compliance Specialist

Rutgers University New Brunswick, NJ

New Brunswick, NJ

9d ago

$108k - $165k/yr Full time Compliance Management Compliance Program Information Security

Apply Now

Job Description

Rutgers University offers a comprehensive benefits package and a collaborative hybrid work environment in New Brunswick, NJ. The Cybersecurity Compliance Specialist role sits within the Office of Information Technology and reports to the Information Security Compliance and Training Manager. This position supports the university in aligning operations with regulatory standards and internal procedures, while engaging across faculties, staff, and external stakeholders.

Benefits

Medical, prescription drug, and dental coverage
Paid vacation, holidays, and various leave programs
Competitive retirement benefits including defined contribution plans and voluntary tax-deferred savings options
Employee and dependent educational benefits where applicable
Life insurance coverage
Employee discount programs

Responsibilities

Document and evaluate compliance activities and liaise with government agencies
Assist and serve as a resource to identify risk gaps and policy needs stemming from updates or mandates to regulatory requirements, including HIPAA, PCI DSS, GLBA, FISMA, the NIST Cybersecurity Framework, and CMMC
Perform other tasks as assigned

Requirements

Bachelor’s degree, preferably in Computer Science, Information Systems, Management Information Systems, or a related field
At least five years of experience in information security programs and knowledge of HIPAA, GLBA, PCI DSS, CMMC, and FISMA regulations and standards
Familiarity with frameworks such as the NIST Cybersecurity Framework, ISO27001-2, ITIL, and project management methodology
Excellent interpersonal, communication, and influencing skills with the ability to collaborate across disciplines and levels inside and outside the organization
Ability to analyze, document, and communicate information security concepts to diverse user bases, including faculty, staff, systems personnel, and external stakeholders
Excellent written and verbal communication and strong documentation and reporting skills
Ability to work in a hybrid environment with standard computing equipment

Preferred Qualifications

CompTIA Security+, CISA, PMP, HCISSP, CMMC, or other related certification
Experience in compliance, cybersecurity, higher education, and/or healthcare
Experience and/or familiarity with learning management systems
Experience with governance, risk, and compliance tools such as Riskonnect and the ServiceNow GRC module
Familiarity with MS Office and video conferencing platforms (MS Teams, WebEx, Zoom) and online learning platforms (KnowBe4, SVI Learner Mobile)

Work Environment and Physical Demands

Hybrid work arrangement with standard computing equipment
Occasional attendance at meetings, events, or travel to locations on or off campus
Lift up to 20 pounds for promotional materials or small equipment
Prolonged periods of sitting or standing while working at a computer

View full job page →

10d ago

Cyber Security Analyst

DEPT OF CITYWIDE ADMIN SVCS New York, NY

New York, NY

10d ago

$115k - $141k/yr Full time Application Security Cloud Platforms Cybersecurity Tools

Apply Now

Job Description

The Cyber Security Analyst supports incident response, threat detection, vulnerability management, governance, risk and compliance, and security operations across DCAS infrastructure, applications, networks, and cloud environments, reporting to the CISO.

Responsibilities

Collaborate with the Agency CISO to ensure cybersecurity related change management and CI/CD practices meet NIST separation of duties requirements.
Support cyber awareness training, security onboarding and readiness assurance, and cloud-based application knowledge transfer for the agency.
Lead and coordinate cybersecurity incident response, digital forensics, malware analysis, threat hunting, containment, eradication, recovery, and post incident activities.
Monitor and analyze security events, alerts, logs, and threat intelligence using SIEM, endpoint protection, cloud security tools, and monitoring platforms.
Conduct vulnerability assessments, risk analyses, remediation tracking, validation testing, and reporting across infrastructure, applications, cloud environments, and endpoints.
Perform cybersecurity audits, control assessments, risk reviews, and compliance evaluations aligned with NIST CSF, NIST SP 800-53, CIS Controls, Zero Trust principles, and Citywide policies.
Develop and maintain cybersecurity policies, standards, procedures, playbooks, incident response plans, and operational documentation.
Support Identity and Access Management operations, including SSO, MFA, RBAC, access reviews, provisioning, deprovisioning, and privileged access governance.
Analyze cybersecurity metrics, trends, vulnerabilities, incidents, and operational performance indicators; produce executive level reports and recommendations.
Collaborate with internal technology teams, application owners, vendors, City agencies, and external partners to improve cybersecurity capabilities and remediation outcomes.
Assist with cloud security reviews, application security assessments, secure application onboarding, and software security initiatives.
Provide technical leadership, mentoring, and guidance to junior cybersecurity staff and cross functional stakeholders.
Assist with audit readiness, evidence collection, regulatory compliance activities, and cybersecurity governance initiatives.
Research emerging threats, technologies, attack techniques, and industry best practices to strengthen defensive capabilities.

Requirements

Baccalaureate degree in computer science, engineering or a related field plus four years of satisfactory full-time experience related to datacenter engineering and operations, cloud engineering and operations, or complex IT infrastructure engineering.
Baccalaureate degree in computer science, engineering or a related field plus eight years of satisfactory full-time experience related to datacenter engineering and operations, cloud engineering and operations, or complex IT infrastructure engineering.
Education and/or experience that is equivalent to either of the above options.

Technologies

Qualys
Wiz
Rapid7
Veracode
HCL AppScan
Snyk
CrowdStrike
Microsoft Defender
SolarWinds SEM
ServiceNow
Jira
GitHub Enterprise Copilot Security
GitHub Copilot
BitSight
Security Scorecard
Shodan
Microsoft Entra ID (Azure AD)
SAML 2.0
OAuth 2.0
OpenID Connect
Conditional Access
MFA
RBAC

View full job page →

10d ago

Cybersecurity Red Team-Penetration Tester

Zions Bancorporation Midvale, UT

Midvale, UT

10d ago

Full time Adversary Testing Application Security Cloud Platforms

Apply Now

Job Description

Zions Bancorporation offers a hybrid Cybersecurity Red Team-Penetration Tester role in Midvale, UT that emphasizes proactive defense and real-world impact. You will identify and exploit complex vulnerabilities across enterprise infrastructure, applications, and cloud environments, design and execute simulated attacks, and collaborate with Incident Response and development teams to strengthen security posture from day one.

Benefits

Medical, Dental and Vision Insurance starting on Day One
Life and Disability Insurance, Paid Parental Leave and Adoption Assistance
Health Savings (HSA), Flexible Spending (FSA), and dependent care accounts
P aid Training, Paid Time Off (PTO) and 11 Paid Federal Holidays
401(k) plan with company match, Profit Sharing, competitive compensation aligned with experience
Mental health benefits including coaching and therapy sessions
Tuition Reimbursement for qualifying employees
Employee Ambassador preferred banking products

Work Location

This position offers a hybrid work from home arrangement with a minimum of three days per week in the office at the new Zions Technology Center in Midvale, UT. The 400,000-square-foot campus sits on the former Sharon Steel Mill superfund site and serves as the company’s primary technology and operations hub. Key features include:

Electric vehicle charging stations and proximity to Historic Gardner Village UTA TRAX station
At least 75% of building power from on-site renewable solar energy
Access to outdoor recreation, parks, trails, shareable bikes and locker rooms
Large modern cafe with a healthy and diverse menu
Healthy indoor environment with ample natural light and fresh air
LEED-certified sustainable building with low VOC-emitting construction materials

Responsibilities

Emulate Advanced Adversaries: Lead comprehensive red team operations and objective-based testing to simulate real-world cyberattacks, evaluating technical controls and incident response readiness
Conduct Multidisciplinary Testing: Perform manual and automated penetration testing across web applications, APIs, cloud environments (AWS/Azure/Kubernetes), internal/external networks, and operating systems (Windows, Active Directory, Linux)
Audit and Attack AI Systems: Design and execute adversarial simulations against Large Language Models and machine learning pipelines to identify enterprise vulnerabilities and ensure resilience of AI applications
Develop Custom Exploits: Create, modify, and optimize scripts and tools to bypass modern EDR agents and navigate restricted environments
Deliver Clear Reporting: Translate complex findings into detailed remediation reports and present risk impact clearly to technical developers and non-technical stakeholders
Collaborate for Remediation: Partner with Cyber Threat Intelligence, Incident Response, Detection Engineering and development teams to provide post-assessment debriefs, validate remediation efforts, and strengthen overall security posture

Requirements

Adversarial Frameworks: Deep practical knowledge of MITRE ATT&CK, OWASP Top 10, and NIST
AI & LLM Vulnerability Exploitation: Practical understanding of LLM top risks and hands-on experience with prompt injection, training data poisoning, model inversion, and API-based data exfiltration
Commercial & Custom Tooling: Proficient use of offensive security suites and platforms such as Cobalt Strike, Burp Suite, Nessus, Nmap, Metasploit, BAS, and related tooling
Active Directory Domain Dominance: Proven experience exploiting AD environments including Kerberos roasting, AS-REP roasting, pass-the-hash, golden/silver tickets, and domain delegation flaws
Scripting & Automation: Strong programming skills in Python, PowerShell, Bash, or Go to automate tasks and build tooling
Cloud Security: Experience identifying misconfigurations and exploiting AWS, Azure, or Kubernetes/Docker environments
Professional Experience: 5+ years focusing on network penetration testing, application security testing, or red teaming
Educational Background: Bachelor's degree in Computer Science, Cybersecurity, Information Security, or related field, or equivalent hands-on experience
Certifications: OSCP or OSCE/OSEP; SANS/GIAC certifications (GPEN, GXPN, GWAPT); HTB CPTS

Technologies

Python, PowerShell, Bash, Go
Cobalt Strike, Burp Suite, Nessus, Nmap, Metasploit, BAS
AWS, Azure, Kubernetes, Docker
Windows, Active Directory, Linux
Large Language Models (LLMs)
MITRE ATT&CK, OWASP Top 10, NIST

View full job page →

10d ago

Cybersecurity Specialist

Abbott Laboratories Abbott Park, IL 🇺🇸 Remote

Abbott Park, IL

10d ago

$78k - $156k/yr Full time Application Security Data Security Information Security

Apply Now

Job Description

Abbott Laboratories is seeking a seasoned Cybersecurity Specialist to identify security risks across product software and implement practical mitigations that align with leading cybersecurity standards. This role offers remote work within the United States and is connected to Abbott Park, IL as the corporate hub. The compensation range for this position spans USD 78,000 to USD 156,000 per year, reflecting the level of expertise and responsibility expected.

Responsibilities

Create and deliver cybersecurity artifacts tied to product software releases and address customer security inquiries with technical guidance.
Help safeguard manufacturing assets by implementing security controls, performing vulnerability assessments, evaluating risk, and driving mitigation activities.
Assess the cybersecurity posture of external vendors and suppliers providing components or services for Abbott products.
Provide project updates, review security policies, track compliance activities, coordinate cybersecurity initiatives, and support audits both internal and external.
Collaborate with development operations and teams to design and deploy monitoring and security solutions for standalone and embedded product software and supporting applications.
Conduct thorough software assessments to identify potential security risks and vulnerabilities.
Contribute to securing applications and computing assets across public, private, and hybrid cloud environments.
Ensure applications adhere to global privacy, security, business resiliency, and compliance frameworks.
Support security system administration activities, assist with configuration reviews, and help implement risk-reducing solutions.
Participate in incident response activities related to products and supporting applications.
Advance the cyber threat and vulnerability management program to ensure consistent identification, analysis, response, and monitoring of threats, events, and vulnerabilities.
Join cross-functional teams to achieve defined security goals and meet technical requirements for detailed implementation plans.
Provide technical guidance and training on potential security risks and prevention strategies.
Develop security content for monthly site security metrics reporting in alignment with global standards to assess program efficacy and efficiency.
Assist with Secure Lifecycle Process (SLP) cybersecurity assessments and threat modeling to ensure industry-standard compliance throughout the software development lifecycle.

Requirements

Bachelor's degree in Computer Science, Information Systems, Engineering, Cybersecurity, or a related field.
Minimum of five years of relevant professional experience, including at least two years in cybersecurity, information security, software security, IT, engineering, or a related discipline.
Solid knowledge of cybersecurity frameworks and standards such as NIST, ISO 27001, IEC 62304, and Purdue Enterprise Reference Architecture (PERA).
Understanding of product safety risk and its relationship to product cybersecurity risk.
Familiarity with secure software development lifecycle (SDLC), vulnerability management, threat modeling, and cybersecurity best practices.
Ability to manage multiple priorities with strong organizational and time-management skills.
Proven critical thinking, analytical abilities, judgment, and problem-solving in dynamic environments.
Effective teamwork and adaptability to rapidly changing business and technology needs.
Excellent documentation, communication, and interpersonal skills.

Preferred Qualifications

Industry-recognized certifications such as CISSP, CISM, CEH, Security+, GSEC, or equivalent are preferred.
Experience or exposure to product security, medical device security, cloud security, or secure software development is preferred.

Technologies

NIST
ISO 27001
IEC 62304
Purdue Enterprise Reference Architecture (PERA)
Secure Lifecycle Process (SLP)
Secure Software Development Lifecycle (SDLC)

Benefits

Career development opportunities
Free health coverage under the Health Investment Plan PPO for the upcoming year
Excellent retirement savings plan with strong employer contributions
Tuition reimbursement, the Freedom 2 Save student debt program, and FreeU education benefit
Recognition as a great place to work across multiple countries and honored by Fortune
Commitment to diversity and support for working mothers, female executives, and scientists