Security Risk Management

Security Risk Management Cybersecurity Jobs

2 jobs found

Today

Cybersecurity Engineer / RMF Specialist

Agile Defense Columbus, OH

Columbus, OH

Today

Full time Cyber Risk Assessment Cyber Security Engineer Cybersecurity Tools

Apply Now

Job Description

Agile Defense is seeking a Cybersecurity Engineer / RMF Specialist to support a federal customer by documenting, assessing, and strengthening the security posture of building and facility control systems. This role is documentation and assessment focused within a small onsite cyber team, helping the customer achieve and maintain an Authority to Operate (ATO) through the RMF process.

Key Responsibilities

Develop and maintain RMF documentation and security artifacts, including system diagrams, system categorization documents, control implementation write-ups, and plans of action.
Collect, consolidate, and organize technical information provided by system owners, engineers, and operations staff into audit-ready deliverables.
Support system categorization and risk assessment activities by preparing required documentation and tracking stakeholder inputs.
Review vulnerability scan results and create remediation plans (POA&Ms), tracking progress through to closure.
Assist with STIG and security control checklists by documenting compliance status and any exceptions.
Maintain accurate inventories of in-scope hardware, software, and documentation.
Coordinate with the government remote cybersecurity team, program managers, and security officers to ensure artifacts meet enterprise expectations.
Provide timely monthly reporting and recurring customer deliverables in the required format.
Support ramp-up phase activities, including capturing and validating documentation from the outgoing team.

Required Qualifications

Meet DoD 8140.03 certification requirements for this role (IAM Level I), such as Security+ CE.
Complete role-based computing environment certification before privileged access within 180 days of the first day.
Hands-on experience supporting the RMF process in a federal, DoD, or similarly complex environment.
Experience producing security documentation and artifacts reviewed by a government ISSM, auditor, or authorizing official.
Bachelor’s degree is not required; candidates with equivalent experience, technical training, or industry certifications will be considered.
Working knowledge of federal cybersecurity frameworks including FIPS 199/200, NIST 800-53, NIST 800-82, and CNSSI 1253.
Familiarity with DoD cybersecurity tools for vulnerability scanning and compliance checking (including ACAS and SCAP) and the ability to interpret outputs.
Strong written communication to convert technical input from engineers and operators into clear, defensible documentation.
Attention to detail and the ability to manage multiple deliverables with overlapping deadlines.
Ability to coordinate with program managers, remote cybersecurity stakeholders, security officers, engineers, and vendors to obtain required inputs.
US Citizenship and the ability to obtain and maintain a Secret security clearance.

Technologies and Frameworks

RMF, DoD 8140.03, Security+ CE, FIPS 199/200, NIST 800-53, NIST 800-82, CNSSI 1253, ACAS, SCAP, STIG, eMASS, Purdue Enterprise Reference Architecture, FedRAMP, Zero Trust, PIA/PRiLA

Preferred Qualifications

Experience uploading and maintaining artifacts in eMASS or a similar RMF package management system.
Experience supporting OT/ICS/SCADA or facility related control systems (for example, building automation and advanced metering).
Knowledge of the Purdue Enterprise Reference Architecture.
Experience supporting ATO or ATC efforts from start to finish.
Familiarity with FedRAMP and Zero Trust principles.
Experience with privacy documentation (PIA/PRiLA) or contingency plan artifacts.
Prior DLA customer experience.

Location

Columbus, OH | Onsite

View full job page →

Today

Senior Security Analyst, Security Risk Management

Plaid Seattle, WA

Seattle, WA

Today

$156k - $214k/yr Full time Senior Ai Security Information Security

Apply Now

Job Description

Plaid is hiring a Senior Security Analyst to strengthen security risk management within the Security Governance, Risk, and Compliance (GRC) program. This role runs end-to-end security risk assessments and turns findings into clear, defensible reporting that leadership and the board can use to make informed security trade-offs.

As part of the GRC team, you will help reduce the likelihood and impact of security risks through a robust assurance approach, partnering across the company to keep Plaid’s platform secure, resilient, and aligned with industry and regulatory expectations.

What you’ll do

Run security risk assessments end-to-end within Plaid’s security risk management program, including intake, scenario-based analysis, treatment decisions, and monitoring across security, infrastructure, and product risk.
Collaborate with engineering SMEs and risk owners on risks such as over-privileged access and supply-chain gaps, as well as product abuse and AI adoption, providing owners a clear basis to accept or mitigate each risk.
Build quarterly security risk reporting and develop security risk content for leadership and board materials.
Integrate security risk into Plaid’s enterprise risk management program so security risk is tracked and weighed alongside broader business risks.
Support program maturity as scope grows, operating as an AI power user who automates parts of the workflow to help the program scale.
Triage intake, conduct scenario-based risk analyses with engineering SMEs, score initial and residual risk, and drive risk owners to a documented treatment decision.
Collect updates on material risks, prepare the Security Risk Review, and build security risk content for executive and board decks.
Partner with enterprise risk stakeholders to map security risks into the enterprise taxonomy, align rating scales, and keep registers synchronized.
Help evolve the risk framework, register, key risk indicators, and risk-owner self-service as the program expands.
Ensure unmet FedRAMP rules and KSI gaps include a documented risk explanation and senior-official acceptance in the Security Decision Record, consistent with the risk register.
Build AI skills and automations for intake triage, first-draft risk analyses, register hygiene, and report generation, and share learnings with the team.

Requirements

Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method.
Technical depth to engage engineers on architecture and controls, with the ability to distinguish real exposure from hypothetical risk.
Experience building or maturing a security risk program, including methodology, register, treatment and exception workflow, and key risk indicators.
Experience integrating security risk into an enterprise risk management program.
Experience preparing quarterly risk reporting and developing security risk content for executive and board decks.
Ability to translate technical risk into a concise executive narrative without overstating or hand-waving.
Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and how risk management feeds each.
Power user who has built AI skills, agents, or automations that materially increase risk-program throughput and shares what works with the team.
Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI).

Tools and frameworks

NIST SP 800-30, FAIR
NIST 800-53, NIST CSF, ISO 27001, SOC 2
FedRAMP 20x
Security Decision Record, SDR-CSO-FRR, SDR-CSX-KSI

Compensation and benefits

Salary: USD 156,000 - 213,600 per year
Additional compensation in the form(s) of equity and/or commission (dependent on the position offered)
Medical, Dental, Vision
401(k)
Pay is based on factors including scope and responsibilities, work experience and skillset, and location; pay and benefits are subject to change.

Location and employment

Seattle, WA (hybrid)
Seattle Office; New York City Office; Raleigh Office; San Francisco HQ
Address: 1000 Dexter Avenue North, Suite 100A, Seattle, Washington, 98109
Full time
Department: All Departments - Risk - Eng

View full job page →

Security Risk Management Cybersecurity Jobs

Cybersecurity Engineer / RMF Specialist

Senior Security Analyst, Security Risk Management

Get Security Risk Management Cybersecurity Jobs alerts