Senior Security Engineer (Risk) (Remote From Anywhere In Colorado)

Role Overview

Senior Security Engineer (Risk) in the Office of Information Security (OIS). You will provide technical leadership as the state modernizes its Risk Management capabilities, evolving security oversight into an integrated, automated maturity model that delivers a data-driven view of the threat landscape.

Responsibilities

• Perform comprehensive, deep-dive technical risk assessments for high-profile state systems and services.
• Evaluate security control implementations across on-prem, cloud, and hybrid environments; identify gaps and create technical remediation plans.
• Lead/advance a Third-Party Risk Management (TPRM) program to support high-volume vendor assessments efficiently and accurately.
• Design and mature scalable TPRM workflows, including automation and governance; collaborate cross-functionally to expand program coverage.
• Translate complex technical vulnerabilities into actionable, executive-ready risk narratives.
• Act as a senior technical liaison and escalation point across engineers, business users, and executive leadership.
• Support the risk management strategic roadmap, including milestones for risk assessments, vendor risk management, and continuous monitoring.

Requirements

• Demonstrated leadership experience and ability to provide technical guidance to diverse stakeholders.
• Deep technical literacy to evaluate security documentation and operationalize risk management tooling.

Nice-to-haves

• Direct experience configuring and operationalizing risk management tooling.
• Experience with third-party/vendor risk management at enterprise scale.