About this opportunity
vTech Solution lists this Information Security Risk Assessor opportunity in richmond, Virginia. Review the employer’s description below for duties, qualifications and application requirements.
Job description
Job Summary:
The Senior Information Security Risk Assessor - PeopleSoft FSCM will lead comprehensive SEC530 risk assessments for PeopleSoft Financials and related business functions. This role involves identifying and evaluating risks, controls, and impacts to ensure the confidentiality, integrity, and availability of sensitive financial and operational data. The assessor will develop risk methodologies, risk registers, and corrective action plans while collaborating closely with IT security auditors and stakeholders.
Responsibilities:
Develop SEC530 risk-assessment methodology, scoring criteria, and risk-treatment categories.
Define system boundaries, critical business processes, sensitive data, technical dependencies, and third-party services.
Conduct interviews and risk workshops with technical, security, fiscal, system-owner, and executive stakeholders.
Identify and evaluate risks related to access control, segregation of duties, unauthorized changes, legacy customizations, and interface security.
Assess risks involving PeopleSoft roles, permissions, custom code, database privileges, and environment separation.
Review control-testing results and assign inherent and residual risk ratings.
Develop and maintain a detailed risk register documenting threats, vulnerabilities, controls, and treatment recommendations.
Prioritize corrective actions and support development of remediation plans and risk acceptance statements.
Prepare and present draft and final risk-assessment reports to leadership and system owners.
Participate in onsite kickoff, draft-review, and final wrap-up meetings.
Required Skills & Certifications:
Active CISSP or CISA certification.
Minimum three years of relevant cybersecurity or IT risk-assessment experience.
Experience leading formal application, system, or enterprise technology risk assessments.
Proficiency in identifying threats, vulnerabilities, business impacts, and risk levels.
Experience developing risk registers and formal risk-assessment reports.
Knowledge of systems handling sensitive financial, tax, payment, vendor, or personally identifiable information.
Ability to provide a reference from another state government agency.
Availability for onsite meetings in Richmond and ability to work from approved U.S.-based locations.
Understanding of SEC530 or comparable government risk-assessment standards.
Preferred Skills & Certifications:
Five or more years of cybersecurity risk-assessment experience.
Prior experience with SEC530, Commonwealth of Virginia, or VITA risk assessments.
Expertise in PeopleSoft FSCM, PeopleSoft Financials, Oracle ERP, and financial-system risk assessments.
Familiarity with Oracle 19c, PeopleTools, WebLogic, Windows, and Linux environments.
Experience assessing Active Directory/LDAP, SFTP, PowerShell, BizTalk, Integration Broker, and database links.
Knowledge of vendor, payment, tax, procurement, accounting, or billing system risks.
Experience evaluating shared and inherited controls in government-hosted environments.
Additional certifications such as CRISC, CISM, CCSP, CGEIT, or ISO 27001 Lead Auditor.
Special Considerations:
Mandatory background check and key-personnel status under the SOR.
Must be able to perform all work from approved U.S.-based locations.
Reference from another state government agency required.
Availability for required onsite meetings in Richmond, VA.
Scheduling:
Work schedule includes participation in onsite kickoff, draft-review, and final wrap-up meetings.
Typical work performed remotely with required onsite presence as specified.
Worksite address
richmond, VA, 23214, US
Who can apply
Review the original listing for work authorization, qualifications and employer requirements.