Senior Cybersecurity Risk Analyst

Conduct cyber risk assessments of activities and operational decisions across the enterprise, identifying risk to the confidentiality, integrity, and availability of enterprise systems and data.

Articulate cyber risk to business and technical leadership in clear, decision-ready terms, framed against the enterprise's risk appetite.

Take lead on cyber risk reviews across a range of assessment types, such as third-party cyber risk assessment, temporary risk acceptance review, and software risk review, and track enterprise artificial intelligence development as it relates to cyber risk.

Work with the Compliance function to ensure that mandatory control interpretations do not leave other cyber risk unaddressed, and that risk treatment is coherent across frameworks.

Evaluate the cyber risk implications of technology decisions, recognizing risk in networking, cloud, endpoint, and identity and access architectures that compliance-only review would not surface.

Articulate when residual cyber risk exceeds the enterprise's appetite and specify the risk reduction required.

Contribute a risk-posture perspective to enterprise scoping and architecture decisions, including the residual risk implications of carved-out certification environments and enclave boundaries.

Improve the operational and procedural aspects of the Cyber GR&C function: assessment methodology, intake, risk articulation standards, evidence handling, and the consistency of risk judgments across the team.

Maintain current knowledge of the cyber risk, threat, technology, and regulatory landscape, and bring that currency into assessments and into the team's collective capability.

Travel up to 25 percent. Perform other position-related duties as assigned.

Demonstrated ability to recognize cyber risk in networking, cloud, and endpoint technologies, and in identity and access management, well enough to assess the decisions of engineering and IT teams independently.

Ability to articulate cyber risk to business leadership in decision-ready terms.

Working knowledge of NIST publications and their relevance to cyber risk and compliance.

Strong written and verbal communication, including the ability to explain technical risk to non-technical stakeholders.

Self-starter able to operate autonomously on ambiguous problems with limited direction.

Ability to travel up to 25 percent.

Typically 8 years of hands-on cybersecurity experience, with demonstrated depth in evaluating real technology environments, not solely policy or audit administration with a Bachelor’s degree in Computer Science, Information Systems or related field plus; or 4 years with Master's

Demonstrated experience in enterprise risk management and in third-party or vendor cyber risk assessment.

Current Security+ or an equivalent industry certification. (Certification establishes the baseline; demonstrated hands-on capability is weighted more heavily than credentials.)

Must be a U.S. Citizen.

U.S. Remote-Telework role; must reside within the United States to work remotely.

The following raise the ceiling for this role. Hands-on depth in the areas below is valued above the number of certifications or degrees held.

Senior certifications such as CISSP or CySA+, and an identity and access credential such as Microsoft SC-300.

Hands-on experience in a Microsoft Azure environment, including Microsoft 365; exposure to Azure Government (GCC High) is strongly preferred.

Direct experience assessing identity and access architectures, including Entra ID, B2B and external identity, conditional access, and privileged access.

Experience in U.S. Federal or Defense Industrial Base (DIB) environments, and familiarity from a risk perspective with CMMC, NIST SP 800-171/172, and DFARS, and with international frameworks such as UK Cyber Essentials, Australian Essential Eight, UK GDPR, and EU NIS2.

Familiarity with multi-framework risk management across standards such as ISO/IEC 27001 and with crosswalk approaches that achieve cohesive risk treatment across frameworks.

Experience improving GR&C operational processes: assessment methodology, intake, and risk reporting.

Bachelor's degree in a related field. A degree is not required and does not substitute for demonstrated hands-on capability; equivalent experience is fully acceptable.

Compensation Details:

$110-$130k

The compensation range or hourly rate listed for this position is provided as a good-faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities, education, experience, skills, internal equity, market data, applicable collective bargaining agreements, and relevant laws.

Benefits Overview:

Our health and welfare benefits are designed to support you and your priorities. Offerings include:

Health, dental, and vision insurance

Paid time off and holidays

Retirement benefits (including 401(k) matching)

Educational reimbursement

Parental leave

Employee stock purchase plan

Tax-saving options

Disability and life insurance

Pet insurance

Note: Benefits may vary based on employment type, location, and applicable agreements. Positions governed by a Collective Bargaining Agreement (CBA), the McNamara-O'Hara Service Contract Act (SCA), or other employment contracts may include different provisions/benefits.

Original Posting:

Amentum anticipates this job requisition will remain open for at least three days, with a closing date no earlier than three days after the original posting. This timeline may change based on business needs.

Amentum is proud to be an Equal Opportunity Employer. Our hiring practices provide equal opportunity for employment without regard to race, sex, sexual orientation, pregnancy (including pregnancy, childbirth, breastfeeding, or medical conditions related to pregnancy, childbirth, or breastfeeding), age, ancestry, United States military or veteran status, color, religion, creed, marital or domestic partner status, medical condition, genetic information, national origin, citizenship status, low-income status, or mental or physical disability so long as the essential functions of the job can be performed with or without reasonable accommodation, or any other protected category under federal, state, or local law. Learn more about your rights under Federal laws and supplemental language at Labor Laws Posters.