Cybersecurity Risk Management Manager

Leads development and implementation of a centralized cybersecurity risk management framework across Maryland's state agencies, architecting and building a statewide framework aligned with NIST standards while establishing third-party risk management programs and ensuring regulatory compliance. Enterprise-wide risk management: designs risk policies and controls, conducts risk assessments and security gap analyses across agencies, establishes Key Risk Indicators and Key Performance Indicators, provides strategic guidance to executive leadership, and leads continuous monitoring. Third-party risk: develops a vendor risk framework, assesses cloud providers and contractors, and coordinates with procurement and legal on contract security requirements. Regulatory compliance: ensures compliance with federal and state cybersecurity, privacy, and AI regulations, leads internal audits and risk reviews, and designs incident response strategies. Minimum qualifications: Bachelor's degree in cybersecurity, IT, or related field and four years' experience creating and maintaining risk management programs aligned with state and federal standards, including one year of supervisory experience; six years' experience may substitute for the degree.