Third-Party Cyber Risk Management Engineer II

Why Join GEICO

At GEICO we offer a rewarding career where your ambitions are met with endless possibilities.

Every day we honor our iconic brand by offering quality coverage to millions of customers and being there when they need us most. We thrive on relentless innovation to exceed our customers expectations while making a real impact on local communities nationwide.

Founded in 1936 GEICO is a member of the Berkshire Hathaway family of companies and one of the largest auto insurers in the United States. When you join our company we want you to feel valued supported and proud to work here. Thats why we offer the GEICO Pledge: Great Company Great Culture Great Rewards and Great Careers.

GEICOs Cybersecurity organization has an exciting opportunity for an accomplished Engineer II Third-Party Cyber Risk Management. This individual will play a key role within GEICOs Trustworthy Engineering organization on the Third-Party Cyber Risk Management (TPCRM) team with a focus on executing the day-to-day third-party inventory assessment reassessment and data-sharing risk work that supports GEICOs third-party cyber risk program.

Position Description:

Our Engineer II Third-Party Cyber Risk Management is responsible for assisting the TPCRM teams efforts to inventory GEICOs third-party ecosystem execute risk-based security assessments and reassessments and enforce secure data-sharing practices for third parties that access GEICO data. This includes maintaining and reconciling third-party records in industry-recognized risk assessment tools and related systems working through the current backlog of third parties missing a required security assessment supporting the teams quarterly commitment to complete all reassessments due and helping monitor the effectiveness of implemented controls under the guidance of senior engineers on the team.

Position Responsibilities

As an Engineer II you will:

• Execute third-party security assessments and reassessments in industry-recognized tools following defined standards for accuracy completeness and timeliness with minimal guidance from senior engineers

• Prioritize and work through the inventory of third parties identified as missing a required TPCRM security assessment helping the team reach 100% completion of outstanding reviews Implement defined industry-recognized risk assessment tools configuration items including inventory attributes assessment workflow steps and reporting fields in support of the broader TPCRM architecture set by senior engineers

• Reconcile third-party records across industry-recognized risk assessment tools and other enterprise systems to identify and close data gaps and validate that data is shared with third parties using approved secure data-sharing methods

• Support centralized tracking of third-party security issues by maintaining issue records monitoring remediation status against SLAs and escalating gaps to senior team members as needed Interest or experience in applying AI/automation (e.g. AI-assisted data classification decisioning logic or reporting) to streamline TPCRM workflows such as intake routing low-risk auto-approvals and dashboard generation reducing manual effort across the assessment and reassessment process

• Contribute to quarterly and executive-level reporting on assessment reassessment and issue-management metrics helping ensure the underlying data is accurate and current

• Collaborate with Supplier Management Legal Data Protection Engineering and business stakeholders to gather the information needed to complete assessments and close third-party data-sharing gaps

• Continuously build proficiency with industry-recognized risk assessment tools third-party risk frameworks and the teams assessment methodologies and seek out mentorship from senior engineers to grow technical and domain expertise

• Conduct root-cause analysis on data-quality issues or defects in third-party records and assessment workflows and implement fixes under senior engineer guidance

• Support the teams roadmap by helping execute the underlying inventory assessment and reassessment work that feeds more advanced capabilities such as risk-based intake and continuous risk assessment

• Actively seek and apply feedback from teammates and senior engineers share knowledge with the team and help teammates work through obstacles and blockers when asked

Qualifications:

• Experience conducting risk or security assessments or supporting reassessment/renewal processes in a cybersecurity IT risk or vendor/third-party risk context

• Experience working with GRC TPCRM or workflow platforms (e.g. industry-recognized risk assessment tools Archer ServiceNow) to execute or track assessments issues or records

• Experience reconciling data across multiple systems and identifying/resolving data-quality gaps

• Working knowledge of cybersecurity and data-privacy regulations and standards relevant to third-party risk (e.g. NYDFS NIST CSF)

• Familiarity with data security and third-party risk frameworks and protocols such as ISO 27001 NIST and CIS

• Strong analytical and problem-solving skills with the ability to execute well-defined tasks reliably and escalate ambiguous issues to senior engineers

• Strong written and verbal communication skills with the ability to build working relationships with teammates and cross-functional stakeholders such as Supplier Management and Legal

• A proactive detail-oriented approach to high-volume deadline-driven work along with a willingness to seek mentorship and feedback to grow technical and domain expertise

One or more of the following cybersecurity certifications are highly desired:

• CompTIA Security (Sec)

• CompTIA Cybersecurity Analyst (CYSA)

• One or more of the following cybersecurity certifications are highly encouraged:

• Certified Information Systems Security Professional (CISSP)

• Certified Information Security Manager (CISM)

• Certified in Risk and Information Systems Control (CRISC)

• Certified Third-Party Risk Professional (CTPRP)

Experience:

• 1-2 years of experience in cybersecurity IT risk or third-party/vendor risk management

• Experience with GRC/TPRM or workflow platforms (e.g. OneTrust Archer ServiceNow) or comparable ticketing/case-management tools preferred

• Experience with data reconciliation reporting or dashboarding tools (e.g. Excel Power BI SQL) preferred

• Familiarity with cloud environments (AWS GCP or Azure) a plus

Education:

• Bachelors degree in Computer Science Information Systems Cybersecurity or equivalent education or work experience

Annual Salary

The above annual salary range is a general guideline. Multiple factors are taken into consideration to arrive at the final hourly rate/ annual salary to be offered to the selected candidate. Factors include but are not limited to the scope and responsibilities of the role the selected candidates work experience education and training the work location as well as market and business considerations.

The GEICO Pledge:

Great Company:Protecting customers through lifes twists and turns with innovation and integrity.

Great Careers:Personalized development programs mentorship and certification assistance.

Great Culture:Inclusive and collaborative culture rooted in shared success.

Great Rewards:Competitive pay benefits and flexibility to support your well-being and future.

The equal employment opportunity policy of the GEICO Companies provides for a fair and equal employment opportunity for all associates and job applicants regardless of race color religious creed national origin ancestry age gender pregnancy sexual orientation gender identity marital status familial status disability or genetic information in compliance with applicable federal state and local law. GEICO hires and promotes individuals solely on the basis of their qualifications for the job to be filled.

GEICO reasonably accommodates qualified individuals with disabilities to enable them to receive equal employment opportunity and/or perform the essential functions of the job unless the accommodation would impose an undue hardship to the Company. This applies to all applicants and associates. GEICO also provides a work environment in which each associate is able to be productive and work to the best of their ability. We do not condone or tolerate an atmosphere of intimidation or harassment. We expect and require the cooperation of all associates in maintaining an atmosphere free from discrimination and harassment with mutual respect by and for all associates and applicants.