IT Security Risk Assessor

The IT Security Risk Assessor is responsible for conducting comprehensive SEC530 risk assessments for the eVA application, its CGI hosted environment, and connected interfaces. This role involves evaluating threats, vulnerabilities, and risks in cloud and SaaS environments, providing prioritized risk treatment recommendations, and supporting risk reporting and communication with stakeholders. The position requires strong expertise in information security risk frameworks and cloud security, working in a hybrid model with remote and onsite sessions in Richmond, VA. Responsibilities:

• Define risk methodology, scope, and data sensitivity in accordance with SEC530 and organizational risk templates.
• Confirm system boundaries, data flows, interfaces, and sensitivity of procurement, vendor, and payment data.
• Identify threats and vulnerabilities across SaaS platforms, AWS hosting, APIs, mobile applications, and data warehouses.
• Rate likelihood and impact of risks, calculate residual risk, and document existing and planned controls.
• Assess disaster recovery, failover capabilities, and third-party vendor risks.
• Prepare interim, draft, and final risk assessment reports including corrective action plans.
• Support weekly status reporting and risk updates to the project management team.

• Minimum 3 years of information security risk assessment experience.
• Strong knowledge of VITA SEC530 and SEC501, NIST SP 800-30, NIST SP 800-53, and NIST RMF.
• Experience assessing SaaS, cloud-hosted applications (AWS), APIs, file-based interfaces, and mobile apps.
• Understanding of financial and payment card data risks and third-party risk management.
• Proficiency with risk registers, heat maps, and interpreting vulnerability scan results (e.g., Tenable, Qualys).
• Ability to translate technical risks into business impact for executive-level sign-off.
• Required Certification: CISSP or CISA.

• Certifications such as CRISC, CISM, CCSP, CCSK, or AWS Certified Security Specialty.
• Prior experience performing SEC530 risk assessments for Virginia agencies.
• Experience with eProcurement or ERP risk assessments.
• Bachelor's degree in Cybersecurity, IT, or related field.

• Must be US based; offshore resources are not permitted.
• Subject to agency-specific background check clearance.
• Hybrid work model requiring remote work with onsite sessions in Richmond, VA, including in-person wrap-up meetings.

• Contract duration of seven months starting the second week of January 2027.
• Work schedule aligned with project timelines and weekly status reporting requirements.