Senior Cybersecurity Risk Analyst

Join to apply for the Senior Cybersecurity Risk Analyst role at State of Washington
.

Description

The Senior Cybersecurity Analyst – Risk Manager is a key contributor to the AOC’s Information Security Program. The role leads cybersecurity risk management activities that support the secure operation of Washington’s Judicial Branch systems and services. The analyst collaborates with internal teams, external partners, and court stakeholders to identify risks, recommend mitigation strategies, and strengthen the overall security posture of the agency.

Position

Details

• Job #: 2025-99
• Status:
  Regular, Full-Time
• Location:
  
  Olympia, Washington
• Salary Range: $93,804 – $123,084 per year (DOQ)
• Opens:
  December 11, 2026
• Closes:
  January 1, 2026

Primary Responsibilities Risk Management & Governance

• Lead the development, implementation, and ongoing maintenance of the AOC’s cybersecurity risk management program.
• Identify, evaluate, and document cybersecurity risks affecting applications, infrastructure, data, and business processes.
• Maintain and oversee the enterprise risk register, ensuring risks are prioritized, assigned, tracked, and remediated.
• Develop, update, and maintain cybersecurity policies, standards, procedures, and guidelines aligned with NIST CSF, CIS Controls, NIST SP 800-53, State
  
  RAMP, and FedRAMP.
• Provide clear, actionable risk-based recommendations to leadership and program owners to guide security decisions and resource allocation.

Application & System Security Assessments

• Conduct security assessments and reviews of new and existing systems, services, and applications—including court-specific applications—to identify security gaps or areas for improvement.
• Evaluate secure architecture design, data flows, authentication models, and access controls using threat modeling and secure development best practices (including OWASP).
• Coordinate with development teams using Azure Dev Ops to ensure security requirements and controls are incorporated early in the system lifecycle.
• Develop and document Plans of Action and Milestones (POA&Ms) and ensure timely remediation of identified risks.

Cloud Security & Enterprise Security Tools

• Participate in governance and validation of security configurations for cloud and hybrid environments, including Microsoft Azure, Microsoft 365, Azure Dev Ops, and Microsoft Defender.
• Participate in the oversight and validation of Tenable vulnerability management activities, including scan scoping, asset coverage, findings analysis, and remediation tracking.

Compliance & Audit

• Assess AOC systems and processes for compliance with applicable state and federal laws, Judicial Branch policies, and industry standards (e.g., NIST, CJIS, PCI, State
  
  RAMP, FedRAMP).
• Coordinate internal and external audits related to cybersecurity controls and documentation.
• Conduct compliance gap analyses and work with technical teams to develop and implement mitigation strategies.
• Prepare compliance reports and maintain documentation to satisfy audit and oversight requirements.

Vulnerability & Threat Management

• Oversee the vulnerability management program, ensuring vulnerabilities are identified, validated, analyzed, scored, prioritized, and remediated.
• Lead the integration of Tenable vulnerability data, Microsoft Defender alerts, threat intelligence, and system logs to produce meaningful risk insights.
• Provide ongoing reporting of vulnerability trends and risk impacts to leadership and stakeholders.

Incident Response & Preparedness

• Serve as an active member of the AOC Enterprise Incident Response Team.
• Provide risk-based guidance during cybersecurity incidents, including impact assessment, containment strategies, and identification of contributing control weaknesses.
• Support post-incident reviews and ensure lessons learned are incorporated into risk management practices and documentation.

Security Documentation & Reporting

• Create, maintain, and publish risk assessment reports, POA&Ms, audit findings, system security documentation, and threat models.
• Prepare executive-level briefings, dashboards, and metrics that communicate risk posture and remediation progress.
• Ensure documentation is clear, accurate, and accessible to relevant…