Director, IT Risk and Compliance

Job Overview

The IT Risk and Compliance Director shall provide on-demand cybersecurity staff augmentation services to support the Department in proactively identifying, analyzing, and mitigating cybersecurity risks across its enterprise environment.

• Conduct comprehensive vulnerability assessments using industry-standard tools and methodologies;
• Perform penetration testing using a structured approach progressing from passive to active techniques;
• Identify and analyze Indicators of Compromise (IOCs), unauthorized access attempts, and data exfiltration risks;
• Apply and interpret Common Vulnerability Scoring System (CVSS) for risk prioritization;
• Conduct threat hunting activities to detect active or persistent threats within enterprise environments;
• Provide incident response support, including containment, eradication, and recovery recommendations.

• Demonstrated experience providing cybersecurity services for large, complex enterprise environments, preferably within government or criminal justice agencies;
• Proven track record delivering threat hunting, vulnerability assessments, penetration testing (internal and external), and incident response services;
• Experience supporting environments subject to Criminal Justice Information Services (CJIS) Security Policy requirements;
• Ability to provide advisory services, including cybersecurity strategy, governance, risk, and compliance (GRC), and remediation planning;
• Minimum five (5) or more years of hands‑on cybersecurity experience in one or more of the following: threat hunting and threat intelligence, penetration testing and ethical hacking, vulnerability management, and Incident response and digital forensics;
• Demonstrated experience operating in both offensive security roles (e.g., red team, penetration testing) and defensive security roles (e.g., Security Operations Center [SOC], blue team, and incident response).

• Experience conducting red team and adversarial simulation exercises;
• Ability to support cybersecurity roadmap development and maturity assessments;
• Relevant industry certifications such as CISSP, CEH, OSCP, GIAC, CISM, and CISA;
• Experience integrating with client Managed Service Providers (MSPs) and internal IT teams.

• A bachelor’s or master’s degree from an accredited college or university in Computer Science, Information Systems, or another related field, or four (4) years of equivalent work experience is required. Relevant experience may be substituted for education on a year‑for‑year basis when applicable.

• Comprehensive Health Insurance with PPO and HDHP/HSA options;
• Dental Insurance;
• Vision Insurance;
• Short/Long-Term Disability;
• Group Life Insurance – Company Paid;
• Voluntary Life Insurance;
• 401(k) Plan with Employer Match;
• Paid Time Off (Vacation/Sick);
• Holiday Pay – Company Paid Federal Holidays;
• Professional Certification Incentive Plan;
• Employee Referral Plan;
• Technology Exposure;

Advanced Systems Design is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.