Senior Compliance & Risk Specialist

Senior Compliance & Risk Specialist (IT Security-Senior Specialist)

WaTech:
Join an exciting team!

Washington Technology Solutions (WaTech) is a national leader in adopting new, innovative technologies that transform the way Washingtonians receive state services. We provide information technology oversight and central services for Washington state government, all of which makes this an exciting time to join our team of experienced IT professionals. As a part of this agency, you will have a unique opportunity to help advance the latest IT technologies and practices used by state government to meet the needs of Washingtonians.

This position is a part of WaTech’s Office of Cybersecurity (OCS), which is focused on advancing the state’s leadership in cybersecurity across the public sector. OCS delivers core cybersecurity services, including the Security Operations Center (SOC), Computer Incident Response Team (CIRT), statewide security projects, and security policy and compliance oversight.

The Senior Compliance and Risk Specialist serves as a statewide subject matter expert in cybersecurity risk management and compliance. This role applies advanced knowledge of cybersecurity principles and practices to the most complex assignments, devises innovative methods to evaluate and mitigate risks, translates technical nuances for diverse audiences, and provides authoritative guidance to agency partners and staff. Through proactive risk management and collaborative support, this role safeguards Washington state’s information systems, supports secure digital services, ensures compliance with applicable state and federal requirements, and sustains public trust in government operations.

• Develop and execute a comprehensive cybersecurity risk assessment strategy across state agencies, applying nationally recognized frameworks, state policies and standards.
• Leverage automation and analytics to monitor statewide progress, track remediation effectiveness, and provide real-time insights into evolving risk posture.
• Identify, analyze and prioritize cybersecurity risks based on impact, likelihood and risk tolerance thresholds applying consistent statewide methodologies.
• Provide agencies with forward-looking guidance on risk treatment options.
• Aggregate and communicate statewide risk posture by consolidating agency-level risk assessments into centralized reports and dashboards.
• Provide subject matter expertise to align Washington state IT security chapter policies and standards with national and federal frameworks.
• Identify systemic barriers to effective risk remediation and champion statewide-level solutions that improve agency adoption and strengthen overall resilience.
• Translate statewide cybersecurity policies and standards into practical, risk-informed guidance and tools.
• Provide senior-level consultation to agency leaders on interpreting and applying policy, bridging the gap between compliance requirements and operational realities.
• Continuously refine statewide reporting practices to incorporate new data sources, analytics and predictive insights that support forward-looking risk governance.
• Foster a statewide community of practice among agency CISOs, CIOs, and risk managers to share knowledge, strengthen collaboration and drive consistent adoption of risk management practices.

• Ten years of experience in information technology, including four years of recent experience in information security in each of these areas:
  • Leading or conducting statewide cybersecurity risk assessments, including application of NIST RMF, NIST SP 800-53, ISO 27005, or equivalent frameworks.
  • Assessing security threats and recommending mitigation strategies and compensating controls across diverse IT environments (cloud, hybrid, on-premises).
  • Cybersecurity compliance management, including interpreting, implementing or auditing IT security policies, standards and regulatory requirements (e.g., FISMA, HIPAA, CJIS, IRS Pub 1075).
  • Developing or operationalizing cybersecurity policies, standards or risk management frameworks.
• A bachelor’s degree in computer science, business administration, information security,…