[Hiring] Enterprise Risk Analyst @MKS2 Technologies

Role Description

The experienced Risk Analyst role executes the VA Enterprise Risk Analysis process using a custom ERA tool to identify key cyber security risk factors in network connected medical devices and Special Purpose Systems (e.g., building automation systems, physical security systems, operational technology). These risk factors are summarized, evaluated, and reported using quantitative and qualitative scores to provide a VA authorizing official with awareness of the residual cyber risk prior to connecting these devices to the VA network.

• Acquire, review and leverage system documentation and data gathered through questionnaires and interviews with customers in the field and vendor/manufacturer representatives.
• Accurately document critical security posture elements in a common reporting format, including:
  • Hardware/software inventory
  • Communications profile
  • System interconnections
  • Data types and stores
  • Presence or lack of security controls, settings and mechanisms for a given device type
• Perform annual reviews to support effective continuous monitoring and ensure documented residual risks are current, accurate, and complete.
• Collaborate with Federal and contractor team mates to achieve best outcomes for the ERA process.

Qualifications

• Experience with Cybersecurity, risk management, or risk assessment for complex systems.
• Experience with NIST SP 800-53 and NIST SP 800-30.
• Experience with documenting and depicting network topology and network protocols.
• Ability to engage directly with clients and third parties to facilitate enterprise risk analysis.
• Ability to obtain and maintain a Public Trust or Suitability/Fitness determination based on client requirements.
• Bachelor’s degree in Computer Science, Mathematics, Engineering or technical discipline and 10 years of relevant work experience or 18 years of relevant work experience in lieu of degree.

Requirements

• Experience with cybersecurity analysis of medical technology or Internet of Things (IoT).
• Experience with Governance, Risk, and Compliance (GRC).
• Experience with Assessment and Authorization (A&A) and eMASS.
• Experience with Excel and Visio.
• CompTIA Security+ or Certified Risk Management Professional (CRISC) or Certified in Risk and Information Systems Control (CRISC).
• Public Trust clearance.

Benefits

• Pay Rate: $110,000-$120,000 based on experience - full benefits available.
• Duration: currently funded through 01/2027 - extension process already ongoing up to 5 years additional.