Risk Specialist

Why live in Helena, Montana?

Helena is surrounded by rolling hills and lofty mountains and is tucked below the Continental Divide.

It is a relatively quiet place to call home where small-town living collides with outdoor adventure.

Helena has a rich history and was originally founded as a gold camp during the Montana gold rush.

Learn more about moving to and/or living in Helena, Montana here.

We know you have other work options, but we ask you to consider working with us at the State of Montana Department of Administration in the State Information Technology Services Division (SITSD). Our mission to provide shared IT services to support the needs of the state and citizens of Montana. We offer an innovative and collaborative work environment where employees are valued and supported.

In addition, our employees have the opportunity to be involved insome of the most exciting and innovative ITprojects and initiatives in development within Montana state government.

State Information Technology Services Division is seeking an experienced Risk Specialist to support the centralized cybersecurity organization by executing cybersecurity risk management processes, conducting risk assessments, documenting risk conditions,maintaining risk documentation, evaluating control effectiveness, and helping customers translate technical findings into actionable treatment decisions under established guidance. The position works across a federated state environment to help assess risk,maintain risk records, registers, and reports, supportpolicyand compliance alignment, andprovidepractical guidance that references statewide standards while considering agency business needs.

The role requires strong analytical ability, willingness to learn, and the ability to communicate risk in plain language to technical, operational, and business stakeholders.

Specialist 3:

Associatedegreein Cybersecurity, Information Technology, Information Assurance, Business, Public Administration, or a related field; AND

4years of experience in cybersecurity risk management, information security, compliance, audit, security assessment, or a closely related field.

Experience leading risk assessments,complexcontrolassessments,or audits.

Alternate combinations of education, experience, and relevant certifications will be considered on a case-by-case basis.

Bachelor's degree in Cybersecurity, Information Technology, Information Assurance, Business, Public Administration, or a related field; AND

Advanced cybersecurity certifications such as CRISC, CISA, CISM, CISSP, etc.

Knowledge of cybersecurity risk management frameworks and standards, including NIST RMF, NIST SP 800-30,NIST SP 800-37,NIST SP 800-53,NIST CSF 2.0,and their practical application in a state government environment.

Knowledge of Information technology (IT) cybersecurity principles and methods such as confidentiality, integrity, availability, authentication, authorization, accountability, encryption, configuration, etc.

Knowledge of common cyber threats, vulnerabilities,attack vectors, and how technical issues translate into business, mission, legal, and reputational impact.

Knowledge of information technology platforms, including hardware, software, network, data storage, cloud service virtualization, security, end-user platforms, etc.

Skill in planning and executing structured risk assessments, including asset identification, threat and vulnerability analysis, likelihood and impact estimation, and residual risk determination.

Skill in evaluating the design and effectiveness of security controls and interpreting assessment, audit, and scan results.

Skill in leading complex risk assessments, including multisystem and cross agency scenarios, and resolving conflicting stakeholder perspectives.

Skill in using GRC platforms, vulnerability management tools, spreadsheets, and ticketing systems to document and track risk work.

Ability to communicate risk in plain language, includingprovidingclear explanation of scenarios, likelihood,…