Cyber Risk Strategist & Assessor

The Opportunity:

As a Cyber Risk Strategist & Assessor, you will collaborate with respected and experienced leaders and seasoned professionals, and work directly with our clients to help them assess their cybersecurity maturity and risk posture to evaluate and improve the effectiveness of their security controls, risk governance, and risk management programs, including AI, Cyber Risk, GRC, SCRM, TPRM, OT, etc. In that capacity, you will lead portions of client delivery and execution with a growing team of Cyber Assessors, Cyber Strategists, Threat & Risk Modelers, and Risk Management professionals. You will work with clients across a variety of industry verticals, including energy, financial services, health or pharmaceuticals, high-tech, and manufacturing.

Leveraging your strategic insights and leadership, you will refine and apply Booz Allen's cyber capabilities and solutions to address each client's strategic, operational, and regulatory assessment and risk advisory needs. You will apply your expertise to lead the identification and assessment of programmatic gaps, technical vulnerabilities, and risks to client systems and environments using qualitative and quantitative approaches. You will also work with clients to develop risk mitigation strategies, identify areas for systemic improvement, and build long-term strategies to ensure assets are secure, and internal and external compliance requirements are addressed. You will evaluate the completeness and effectiveness of risk governance and risk management programs across multiple risk domains in executing the risk management lifecycle. To address inefficiencies and findings, you will work with clients to write risk policy, standards, processes, and procedures, develop risk and performance indicators, design operating models, develop cost models in Excel, and configure eGRC platforms to execute a Risk Management Framework.

You will work with Account Managers and Capability or Market leaders to build relationships with clients and identify future opportunities for capturing strategic clients. You will contribute to or lead work capture activities, including facilitating sales meetings, responding to Request for Proposals (RFPs), constructing bespoke project approaches, authoring proposals and Statements of Work (SOW), and designing staffing approaches.

You will provide leadership and support for a growth-minded business that seeks to continuously evolve and incorporate new techniques and technologies to deliver differentiated and industry-leading capabilities for clients. You will partner with our other delivery teams to design, build, and deliver integrated solutions to the market. Due to the nature of work performed within this facility, U.S. citizenship is required.

Join us. The world can't wait.

You Have:

• 5+ years of experience executing engagements in Cyber Risk Management, Third-Party Risk Management (TPRM), Supply Chain Risk Management (SCRM), Technology Risk Management (TRM), or GRC Programs, including delivering results to C-level executives and Director-level stakeholders

• 5+ years of experience executing cybersecurity assessments against industry-standard frameworks such as NIST CSF, NIST 800-53, CIS Critical Security Controls, and ISO 27001 and identifying root cause issues, analyzing vulnerabilities, and proposing threat and risk-aligned mitigations that materially enhance organizational cyber resilience and improve the security risk posture

• 3+ years of experience implementing or auditing third-party risk management programs in accordance with industry frameworks such as NIST SP 800-161

• 3+ years of experience evaluating and managing third-party relationships throughout their lifecycle, including onboarding and due diligence, assessment of risk, risk mitigation and remediation, continuous monitoring, and offboarding

• Experience evaluating and implementing controls aligned with regulatory frameworks such as GDPR, CCPA, CPRA, and state-based legislation, including HIPAA or PCI DSS

• Experience with project management, including delivering results within specified timelines and budgets and on cross-functional engagement teams

• Knowledge of cyber threat modeling and risk management frameworks and methodologies such as FAIR, NIST RMF, COBIT, MITRE ATT&CK, PASTA, or STRIDE

• Knowledge of technology and cybersecurity functions such as asset management, identity and access management, cloud security, network security, security operations, or incident response and technologies such as SIEM, EDR, IPS/IDS, SAST, DAST, CASB/DLP, CSPM, or CWPP

• Bachelor's degree

Nice If You Have:

• Experience communicating complex technical ideas to broad audiences across all organizational levels, including executives such as board members, CEOs, CFOs, CTOs, and CISOs, via white papers, assessment reports, and briefs

• Experience with application security or product security, including using DevOps, DevSecOps, and SDLC

• Experience with cloud assessment methodologies, including utilizing built-in processes for assessing native cloud services, and with optimizing cloud infrastructure for efficiency, security, and cost-effectiveness

• Experience with Windows or Linux system administration, including managing and securing operating systems effectively

• Experience administering and assessing network devices and security, including routers, switches, firewalls, and intrusion detection or prevention systems

• Knowledge of SOC or threat hunting, including threat modeling and analysis

• Knowledge of emerging topics, including regulations, industry practices, and new technologies, including AI, Cyber Risk Quantification (CRQ), and Zero-Trust Architecture (ZTA)

• Ability to identify technology vulnerabilities using both manual and automated processes, including automated compliance and vulnerability scanners and system configuration reviews such as CIS Benchmarks or DISA STIGS

• Master's degree in Information Technology, Cybersecurity, Computer Science, Systems Engineering, or Security Policy

• CISSP, CGRC, CRISC, CEH, GSEC, CISM, CISA, COBIT 5, FAIR, MITRE ATT&CK, OSCP, Certified Incident Handler (GCHI), GIAC Enterprise Incident Response (GEIR), or MITRE Threat Hunting Certification

Compensation

At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen's benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.

Identity Statement

As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Work Model
Our people-first culture prioritizes the benefits of flexibility and collaboration, whether that happens in person or remotely.

• If this position is listed as remote or hybrid, you'll periodically work from a Booz Allen or client site facility.
• If this position is listed as onsite, you'll work with colleagues and clients in person, as needed for the specific role.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.