Risk Specialist 2 or 3

What are we looking for

Education and Experience:

Specialist 2:

• Associate degree inCybersecurityInformation TechnologyBusiness Public Administration or a related field; AND

• 2years of experience incybersecurity risk management information security compliance audit security assessment or a closely related field.

• Alternate combinations of education experience and relevant certifications will be considered on a case-by-case basis.

Specialist 3:

• Associatedegreein Cybersecurity Information Technology Information Assurance Business Public Administration or a related field; AND

• 4years of experience in cybersecurity risk management information security compliance audit security assessment or a closely related field.

• Experienceleading riskassessmentscomplexcontrolassessmentsor audits.

• Alternate combinations of education experience and relevant certifications will be considered on a case-by-case basis.

Preferred:

• Bachelors degree in Cybersecurity Information Technology Information Assurance Business Public Administration or a related field; AND

• Advanced cybersecurity certifications such as CRISC CISA CISM CISSP etc.

Competencies:

Required knowledge skills and abilities:

• Knowledge of cybersecurity risk management frameworks and standards including NIST RMF NIST SP 800-30NIST SP 800-37NIST SP 800-53NIST CSF 2.0and their practical application in a state government environment.

• Knowledge of Information technology (IT) cybersecurity principles and methods such as confidentiality integrity availability authentication authorization accountability encryption configuration etc.

• Knowledge of common cyber threats vulnerabilitiesattackvectors and how technical issues translate into business mission legal and reputational impact.

• Knowledge of information technology platforms including hardware software network data storage cloud service virtualization security end-user platforms etc.

• Skill in planning and executing structured risk assessments including asset identification threat and vulnerability analysis likelihood and impact estimation and residual risk determination.

• Skill in evaluating the design and effectiveness of security controls and interpreting assessment audit and scan results.

• Skill in leading complex risk assessments including multisystem and cross agency scenarios and resolving conflicting stakeholder perspectives.

• Skill in using GRC platforms vulnerability management tools spreadsheets and ticketing systems to document and track risk work.

• Ability to communicate risk in plain language includingprovidingclear explanation of scenarios likelihood impact and treatment options such as avoid mitigate transfer or accept.

• Ability to exerciseindependent expert judgment in ambiguous and high impact situations including advising on risk acceptance when standards and precedents are limited.

• Ability to identifycontrol gaps inconsistencies and emerging issues in complex technical procedural and architectural documentation.

• Ability to mentor coach and provide informal leadership toteammembers in risk techniques documentation standards and stakeholder communication.

• Ability to operate effectively in a federated state environment balancing centralized standards with agency autonomy and relationship management.

Does this sound like you

Please tell us how and why by submitting your resume and cover letter. (Please Note: You do not need to complete the work experience or the education & certifications portion of the application process in our recruiting system. You only need to upload the requested documentation.)

What can you expect from us in return for your hard work

Ø Look here to see the additional benefits! They include:

o Work/life Balance

o Health Coverage

o Retirement plans

o Paid Vacation and Sick Leave and Holidays

o And more

Ø Public Service Loan Forgiveness (PSLF) Employment with the State of Montana may qualify you to receive student loan forgiveness under the PSLF.

Other important information to be aware of.

• This position requires successful completion of a criminal background check.
• Only online applications are accepted. By applying online you can receive updates and monitor the status of your application.
• The Department of Administration participates in E-Verify to confirm employment eligibility. After accepting a job offer and completing form I-9 your information will be submitted to the Department of Homeland Security and Social Security Administration for verification. For more information about E-Verify please visit the E-Verify website found here first review of applicants will take place on July 2 2026.
• In this position you will be afforded the opportunity to telework however there will be required weekly in-office day(s) in Helena. Specific conditions will be outlined as part of the job offer and must adhere to state policy.