Senior Cybersecurity Analyst

Amentum is a global leader in advanced engineering and innovative technology solutions, trusted by the United States and its allies to address their most significant and complex challenges in science, security and sustainability. Our people apply undaunted curiosity, relentless ambition and boundless imagination to challenge convention and drive progress. Our commitment s are underpinned by the belief that safety, collaboration and well-being are integral to success.

Headquartered in Chantilly, Virginia, we have approximately 50,000 employees in more than 70 countries across all 7 continents.

The Senior Cybersecurity Risk Analyst is a US remote, senior individual contributor position within the Cybersecurity Governance, Risk, and Compliance (GR&C) team. This role owns the enterprise's cyber risk assessment work: evaluating activities and operational decisions across the enterprise and articulating the resulting cyber risk to business leadership against the enterprise's risk appetite.

The work is assessment heavy. The Senior Cybersecurity Risk Analyst examines technology and operational decisions for cyber risk that compliance-driven review alone does not surface, then frames that risk in business terms so GR&C and leaders can make informed accept, mitigate, or remediate decisions. The role is a twin to the Compliance function: where Compliance concentrates on the administrative work of demonstrating conformance to mandatory controls, this role works alongside it to drive cohesive cyber risk management across the enterprise regardless of which framework imposes a given requirement.

Consistent with the GR&C charter, the role helps protect Amentum against internal and external cyber threats and helps set, improve, and make recommendations on the enterprise security program based on industry best practices, regulations, policies, standards, and guidelines. GR&C surfaces and advises on risk so that business and operational owners can make informed decisions. This person must be technical enough to recognize risk in networking, cloud, endpoint, and identity decisions made by engineering and IT, and credible enough that their risk judgments carry weight with those teams and with leadership.

The role acts on behalf of the entire enterprise rather than any single team, contract, or project, and brings attention to risk without hindering the business.
This position is US remote telework and requires US Citizenship.

• Conduct cyber risk assessments of activities and operational decisions across the enterprise, identifying risk to the confidentiality, integrity, and availability of enterprise systems and data.
• Articulate cyber risk to business and technical leadership in clear, decision-ready terms, framed against the enterprise's risk appetite.
• Take lead on cyber risk reviews across a range of assessment types, such as third-party cyber risk assessment, temporary risk acceptance review, and software risk review, and track enterprise artificial intelligence development as it relates to cyber risk.
• Work with the Compliance function to ensure that mandatory control interpretations do not leave other cyber risk unaddressed, and that risk treatment is coherent across frameworks.
• Evaluate the cyber risk implications of technology decisions, recognizing risk in networking, cloud, endpoint, and identity and access architectures that compliance-only review would not surface.
• Articulate when residual cyber risk exceeds the enterprise's appetite and specify the risk reduction required.
• Contribute a risk-posture perspective to enterprise scoping and architecture decisions, including the residual risk implications of carved-out certification environments and enclave boundaries.
• Improve the operational and procedural aspects of the Cyber GR&C function: assessment methodology, intake, risk articulation standards, evidence handling, and the consistency of risk judgments across the team.
• Maintain current knowledge of the cyber risk, threat, technology, and regulatory landscape, and bring that currency into assessments and into the team's collective capability.
• Travel up to 25 percent. Perform other position-related duties as assigned.

• Demonstrated ability to recognize cyber risk in networking, cloud, and endpoint technologies, and in identity and access management, well enough to assess the decisions of engineering and IT teams independently.
• Ability to articulate cyber risk to business leadership in…