Senior Security Risk Management SME

## Overview Tharros combines extensive cyber defense knowledge with the world’s preeminent vulnerability expertise to identify and defend against attacks before they become problems. Working at mission speed, we harden mission systems faster and secure them for longer, so agencies never lose the mission edge. Tharros lifts the veil of enterprise cybersecurity to detect zero days before they affect you, enabling mission maneuverability and the confidence to move missions forward. In the ever-evolving realm of cyberspace, we are dedicated to becoming the paramount defender in the 5th warfighting domain. By pioneering innovative security solutions and fostering an environment of continuous learning and vigilance, we aim to protect the interests of our nation’s security. Our commitment to excellence in cybersecurity will establish new benchmarks, transforming the digital landscape into a secure and thriving frontier for future generations. **Tharros. See Everything. Secure Anything.** *Tharros is committed to hiring and retaining a diverse workforce. We are proud to be an Equal Opportunity/Affirmative Action Employer and make employment decisions without regard to race, color, religion, creed, sex, sexual orientation, gender identity, marital status, national origin, age, veteran status, disability, or any other protected status.* ## Description Tharros is seeking a **Senior Security Risk Management SME** to support a DHS Intelligence and Analysis cybersecurity program in the National Capital Region. This role will support enterprise cybersecurity risk management, Assessment and Authorization, continuous monitoring, FISMA compliance, secure cloud and hybrid engineering, and risk-based decision support across a complex mission environment. The ideal candidate can help translate security data, authorization evidence, vulnerabilities, POA&M status, and compliance requirements into clear risk insights and actionable remediation priorities. Responsibilities: - Support enterprise cybersecurity risk management across classified and unclassified mission environments. - Lead or support Assessment and Authorization activities for Federal information systems. - Support security control assessments aligned to NIST, CNSSI, Intelligence Community, and Federal cybersecurity requirements. - Review and validate security artifacts, including System Security Plans, Security Assessment Plans, Security Assessment Reports, POA&Ms, and authorization evidence. - Support POA&M development, validation, remediation tracking, closure, and reporting. - Collaborate with system owners, ISSOs, developers, engineers, assessors, and other stakeholders to address findings and strengthen security posture. - Provide risk mitigation recommendations for assigned systems, networks, applications, and environments. - Support continuous monitoring activities that maintain system security posture over time. - Help improve and automate A&A, continuous monitoring, evidence management, and risk reporting processes. - Support quality reviews and process improvements for authorization documentation and security control implementation. - Translate complex security, compliance, and technical data into leadership-ready risk insights, dashboards, briefings, and remediation recommendations. - Support risk management activities across cloud, hybrid, cross-domain, and secure mission environments. ## Requirements - Active TS/SCI w Poly - 10+ years of related cybersecurity risk management experience. - At least 2 years of recent experience in each of the following areas: A&A, FISMA compliance, IC cybersecurity policy and standards, continuous monitoring, CDS, and secure cloud and hybrid engineering. - Experience with emerging and evolving security risk management practices, including automation of A&A and continuous monitoring activities. - Experience applying NIST 800 series, CNSSI 1253, security controls, and RMF principles. - CISM, CAP, or GRC certification, or comparable demonstrabl…