Enterprise Risk Analyst-Cybersecurity/NIST

About the roleCore Hours: 9am-5pm ESTThe experienced Risk Analyst. The role executes the VA Enterprise Risk Analysis process using a custom ERA tool to identify key cyber security risk factors in network connected medical devices and Special Purpose Systems (e.g., building automation systems, physical security systems, operational technology). These risk factors are summarized, evaluated, and reported using quantitative and qualitative scores to provide a VA authorizing official with awareness of the residual cyber risk prior to connecting these devices to the VA network.What you'll doRisk Analyst must acquire, review and leverage system documentation and data gathered through questionnaires and interviews with customers in the field and vendor/manufacturer representatives to accurately document critical security posture elements in a common reporting format. These elements include hardware/software inventory, communications profile, system interconnections, data types and stores, and the presence or lack of security controls, settings and mechanisms for a given device type.The analyst works within the Specialized Device Cybersecurity Department Risk Management team and is expected to collaborate with Federal and contractor team mates to achieve best outcomes for the ERA process.QualificationsExperience with Cybersecurity, risk management, or risk assessment for complex systemsExperience with NIST SP 800-53 and NIST SP 800-30Experience with documenting and depicting network topology and network protocolsAbility to engage directly with clients, and third parties to facilitate enterprise risk analysisAbility to obtain and maintain a Public Trust or Suitability/Fitness determination based on client requirementsBachelor's degree in computer science, Electronics Engineering, or technical equivalent and 10 years of professional experience or a total of 18 years in lieu of educationNice If You Have:Experience with cybersecurity analysis of medical technology or Internet of Things (IoT)Experience with Governance, Risk, and Compliance (GRC)Experience with Assessment and Authorization (A&A) and eMASSExperience with Excel and VisioCompTIA Security+ or Certified Risk ManagementProfessional (CRISC) or Certified in Risk and Information Systems Control (CRISC)Public Trust clearanceSalary range-$90k-$110k Apply tot his job