Primary responsibility: Own the assessment methodology, control mapping, cybersecurity maturity evaluation and final recommendations.

Key responsibilities

• Lead the transition from existing ACET assessment results to the applicable CRI Cyber Profile version.
• Map CRI diagnostic statements to existing BFSFCU controls, policies, procedures and applicable regulatory obligations.
• Define rating criteria, evidence standards and assessment procedures.
• Facilitate workshops with IT, security, risk, compliance and business control owners.
• Evaluate control gaps, residual risks and remediation priorities.
• Produce the executive assessment report and present findings to leadership.

Mandatory skills

• Cybersecurity GRC and enterprise risk assessments.
• Strong NIST CSF 2.0 and control framework mapping experience.
• Knowledge of NCUA and FFIEC expectations for financial institutions.
• Evidence-based control testing and maturity assessments.
• Risk scoring, gap analysis and executive-level reporting.

Preferred: Hands-on CRI Profile experience; ACET, CISSP, CISA, CRISC or CISM.