Identity Risk Analyst

Vendor Notes 

Please submit your best qualified candidates as soon as possible - we will only be accepting a specific quantity before placing on hold.

Key Required Skills:

• Working knowledge of NIST SP 800-63-4, fraud prevention, identity verification, risk analysis, cybersecurity, financial crime, or a related field.

  Position Description:

• Analyze documents and conduct intake and elicitation sessions with project teams.
• Decompose applications or services into the analytical components required for impact assessment.
• Conduct initial impact assessments and document the chain of reasoning supporting each determination.
• Document each application or service’s impact assessment, assurance level selections, and any tailoring decisions.
• Re-engage with project teams when service scope, user populations, transaction types, or threat conditions change in ways that affect prior risk and determination.
• Produce analytical written products — risk assessments, impact assessments, security plan sections, control assessment reports, or equivalent.
• Applying a normative framework (NIST SP 800-63, 800-30, 800-37, or equivalent) to a specific service and producing a written analysis that shows the judgments made at each step.

• Skills Requirements:

  Foundation for Success (Basic Qualifications)

  • Bachelor’s or higher degree in Computer Science, Information Systems, Cybersecurity, Mathematics, Statistics, Philosophy, Law, Economics, or a related analytical discipline.
  • Working knowledge of NIST SP 800-63-4, especially the base volume, and the NIST Risk Management Framework (SP 800-37).

    Factors To Help You Shine (Required Skills)

    **Selected candidate must be able to obtain and maintain a public trust clearance**
    **Selected candidate must be willing to work on-site in Woodlawn, MD 5 days a week**
    **Master''s and 5+ years of experience, Bachelor''s and 7+ years of experience or 13+ years in lieu of a degree**

    • Experience in fraud prevention, identity verification, risk analysis, cybersecurity, financial crime, or a related field.
    • Direct experience conducting digital identity risk assessments under NIST SP 800-63 (Revision 3 or 4) for production online services
    • Experience following the below steps:

    - Analytical decomposition: Reliably breaks complex systems into the components required for the analysis.

    - Rubric application: Applies a written rating rubric to a specific case by identifying the rubric row that matches the case and recording the corresponding rating. Does not substitute personal judgment for the rubric where the rubric is determinative.

    - Categorical reasoning: Can determine whether an impact category applies to a given situation before rating its severity.

    - Source-and-direction tracking: Distinguishes information the system holds about a user from information the user provided to the system.

    - Elicitation: Obtains required information from stakeholders, particularly when the information initially received is incomplete or conflicting.

    - Written precision: Produces clear analytical prose. Reasoning is traceable. Conclusions are tied to evidence.

    - Critical thinking: Evaluates information and arguments for soundness, identifies unstated assumptions, and distinguishes claims that are supported from those that are not.

    - Self-direction: Manages a queue of assessments without daily supervision and surfaces blockers early.

    How To Stand Out From The Crowd (Desired Skills)

    • Professional certifications: CISSP, CISA, CIPP/G, or equivalent would be a plus.
    • Strong attention to detail and organizational skills.
    • Proficiency with Microsoft Excel and standard business applications.

    Ability to manage multiple priorities in a fast-paced environment while maintaining accuracy.