Cyber Risk and Vulnerability Lead; Remote

The Office of the Chief Information Officer (OCIO) advances the Department of Energy's (DOE) mission by establishing enterprise-wide policy, standards, and services that ensure secure, reliable, and innovative information technology (IT) delivery across the Department. The OCIO is committed to strengthening DOE's cybersecurity posture, improving IT service performance, and ensuring the protection of the Department's systems, networks, and data while maintaining responsible stewardship of taxpayer resources.

To join our team of outstanding professionals, apply today!

Cyber Risk and Vulnerability Lead is a subject matter expert who supports this mission by leading cybersecurity measures, assessing security controls, evaluating system risks, and leading efforts to respond to cybersecurity data calls, research, and analysis. This role combines deep experience and understanding of cybersecurity functions and oversight and compliance responsibilities, ensuring DOE systems remain compliant, secure, and resilient.

• Ensures the appropriate implementation of cybersecurity policies, principles, and practices across information technology and cybersecurity services.
• Collaborates with IT and cybersecurity line management to develop security solutions that maintain information assurance across the enterprise.
• Collaborates with cybersecurity personnel to assess and validate new cybersecurity tools and processes. Evaluates the enterprise's overall status against established benchmarks.
• Leads the enterprise-wide risk and vulnerability management efforts for key areas, typically overseeing a small team of senior technical professionals.
• Serves as a subject matter expert in cyber risk and vulnerabilities, with in-depth knowledge of cybersecurity, risk management, vulnerabilities, and best practices for strengthening and enhancing the enterprise security posture.
• Applies principles, methods, and expertise in cyber risk and vulnerability management across relevant technical and engineering disciplines to develop sound, secure solutions for applications and systems.
• Conducts briefings to Federal Leadership and possesses and applies subject matter expertise across key tasks and high-impact assignments.
• Serves as a security and technical expert across multiple project assignments.

• Perform cybersecurity, risk, and vulnerability analysis and guidance of NIST and FISMA systems, including subsystems within respective system boundaries.
• Effectively communicate findings, articulate the potential cybersecurity implications of identified risks, vulnerabilities, and weaknesses, and work through recommended resolutions.
• When determining and assessing risks, evaluate the likelihood that a threat will exploit a vulnerability, as well as the potential impact on operations or data.
• Provide oversight and leadership by advising IT and engineering teams on prioritizing fixes according to real-world implications, business risk, and business impacts.
• To meet compliance objectives, ensure enterprise applications and systems adhere to all applicable legal, governmental, and industry security requirements.
• Establish and maintain strong relationships across teams of cybersecurity professionals, including Information System Security Officers (ISSOs), System Owners (SOs), and Technical Points of Contact (TPOCs).
• Provide leadership and guidance in responding to cybersecurity and system vulnerability data requests for internal and external audits and reporting, as needed.
• Provide leadership in communicating complex technical risks clearly and concisely to management, executive leaders, and other federal officials.
• Act as the primary liaison and point of contact among operational security teams, third-party system owners, contractors, government, and federal executive leadership.

• Bachelor's Degree in an information technology-related field and eight (8) years of work experience in Information Technology.
• At least four (4) years of experience performing risk and vulnerability assessments on progressively more complex systems and projects.
• Experience in cybersecurity operations, security control assessments, or other related technical security functions.
• Ability to ensure the appropriate application of cybersecurity policies, principles, and practices across information technology and cybersecurity services.
• Demonstrated experience collaborating with IT and cybersecurity leadership to develop security solutions that…