Cyber Risk Management Analyst

Title:

Cyber Risk Management Analyst

At KBR, we deliver science, technology and engineering solutions to governments and companies around the world. KBR employs approximately 37,000 people worldwide with customers in more than 85 countries and operations in over 28 countries. KBR is proud to work with its customers across the globe to provide technology, value-added services, and long-term operations and maintenance services to ensure consistent delivery with predictable results.

Trinzic is the future independent company to be created through the planned spin-off of KBR's Mission Technology Solutions business, expected in January 2027. Our people work at the frontier of what is possible, delivering solutions in challenging environments and advancing some of the world's highest-priority national security and space missions.

Backed by decades of mission success, deep expertise, and trusted partnerships, Trinzic will launch as a global organization with more than 18,000 employees supporting customers around the world. Join us at a defining moment and help shape the future of a company built to tackle complex challenges and make a meaningful impact.

Candidates who join KBR's Mission Technology Solutions business before the spin-off will transition to Trinzic when the separation is complete and will not need to reapply for employment.

We are seeking a highly skilled Cyber Risk Management Analyst to support the assessment, governance, and continuous improvement of cybersecurity risk management practices across the organization. This role will be responsible for evaluating cyber risks, conducting security assessments, monitoring compliance, and developing security controls that help safeguard critical systems and data. The successful candidate will serve as a trusted advisor to technical and business stakeholders, helping ensure security and risk management principles are effectively integrated throughout the development lifecycles.

Key Responsibilities

• Conduct cybersecurity risk assessments to identify, analyze, and prioritize risks associated with enterprise technologies, applications, and AI-enabled systems.

• Evaluate the effectiveness of cybersecurity controls, identify security gaps and noncompliance, assess associated risks, and coordinate remediation or risk treatment activities with stakeholders.

• Perform security testing, assessments, and continuous monitoring activities to identify vulnerabilities and recommend remediation strategies.

• Plan, execute, and monitor phishing simulation campaigns, analyze results, identify trends, and coordinate security awareness training and follow-up activities to reduce organizational risk.

• Partner with AI development, engineering, and business teams to integrate security and risk management requirements throughout the AI system lifecycle.

• Support security governance initiatives by documenting risks, tracking remediation efforts, and reporting on risk posture to stakeholders.

• Analyze emerging cyber threats, vulnerabilities, and technology trends to proactively strengthen organizational security practices.

• Contribute to the development and refinement of cyber risk management processes, methodologies, and operating procedures.

• Assist in the creation of training materials and awareness programs related to cybersecurity risk management and AI security.

• Collaborate with cross-functional teams to drive a culture of security, compliance, and continuous improvement.

Basic Qualifications

Education & Experience

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field.

• Minimum of 5 years of experience in cybersecurity, cyber risk management, information security governance, or a related discipline.

• Experience conducting risk assessments, security testing, compliance reviews, and vulnerability management activities.

• U.S. Citizenship is required.

Technical & Leadership Skills

• Knowledge of cybersecurity frameworks such as NIST CSF, NIST RMF, and ISO 27001.

• Understanding of AI security concepts, AI governance, and risks associated with machine learning and generative AI technologies.

• Experience assessing vulnerabilities and implementing security controls within cloud, application, or AI environments.

• Strong analytical, problem-solving, and communication skills.

• Ability to work effectively across technical and business teams.

Preferred Qualifications

• CISSP, CISM, CRISC, Security+, CCSP, or similar certifications.

• Experience supporting government, defense, critical infrastructure, or highly regulated environments.

• Knowledge of the NIST AI Risk Management Framework (AI RMF).

• Experience with AWS, Azure, or Google Cloud security.

• Familiarity with DevSecOps practices, secure software development, and AI model governance.

Location: The ideal candidate will be located near the Chantilly, VA office, however candidates located within commuting distance of a Trinzic office are welcome and encouraged to apply.

Additional Compensation:

• KBR may offer bonuses, commissions, or other forms of compensation to certain job titles or levels, per internal policy or contractual designation. Additional compensation may be in the form of sign on bonus, relocation benefits, short term incentives, long term incentives, or discretionary payments for exceptional performance.

Belong, Connect and Grow at KBRAt KBR, we are passionate about our people and our Zero Harm culture. These inform all that we do and are at the heart of our commitment to, and ongoing journey toward being a People First company. That commitment is central to our team of team’s philosophy and fosters an environment where everyone can Belong, Connect and Grow. We Deliver – Together.

KBR is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law.