Third-Party Cyber Risk Management - Engineer II

Why Join GEICO?

At GEICO, we offer a rewarding career where your ambitions are met with endless possibilities.

Every day we honor our iconic brand by offering quality coverage to millions of customers and being there when they need us most. We thrive on relentless innovation to exceed our customers' expectations while making a real impact on local communities nationwide.

Founded in 1936, GEICO is a member of the Berkshire Hathaway family of companies and one of the largest auto insurers in the United States. When you join our company, we want you to feel valued, supported, and proud to work here. That's why we offer the GEICO Pledge: Great Company, Great Culture, Great Rewards, and Great Careers.

GEICO’s Cybersecurity organization has an exciting opportunity for an accomplished Engineer II – Third-Party Cyber Risk Management. This individual will play a key role within GEICO’s Trustworthy Engineering organization, on the Third-Party Cyber Risk Management (TPCRM) team, with a focus on executing the day-to-day third-party inventory, assessment, reassessment, and data-sharing risk work that supports GEICO’s third-party cyber risk program. 

Position Description:

Our Engineer II – Third-Party Cyber Risk Management is responsible for assisting the TPCRM team’s efforts to inventory GEICO’s third-party ecosystem, execute risk-based security assessments and reassessments, and enforce secure data-sharing practices for third parties that access GEICO data. This includes maintaining and reconciling third-party records in industry-recognized risk assessment tools and related systems, working through the current backlog of third parties missing a required security assessment, supporting the team’s quarterly commitment to complete all reassessments due, and helping monitor the effectiveness of implemented controls, under the guidance of senior engineers on the team.

Position Responsibilities

As an Engineer II, you will:

• Execute third-party security assessments and reassessments in industry-recognized tools, following defined standards for accuracy, completeness, and timeliness, with minimal guidance from senior engineers

• Prioritize and work through the inventory of third parties identified as missing a required TPCRM security assessment, helping the team reach 100% completion of outstanding reviews Implement defined industry-recognized risk assessment tools configuration items, including inventory attributes, assessment workflow steps, and reporting fields, in support of the broader TPCRM architecture set by senior engineers

• Reconcile third-party records across industry-recognized risk assessment tools and other enterprise systems to identify and close data gaps, and validate that data is shared with third parties using approved, secure data-sharing methods

• Support centralized tracking of third-party security issues by maintaining issue records, monitoring remediation status against SLAs, and escalating gaps to senior team members as needed Interest or experience in applying AI/automation (e.g., AI-assisted data classification, decisioning logic, or reporting) to streamline TPCRM workflows such as intake routing, low-risk auto-approvals, and dashboard generation, reducing manual effort across the assessment and reassessment process

• Contribute to quarterly and executive-level reporting on assessment, reassessment, and issue-management metrics, helping ensure the underlying data is accurate and current

• Collaborate with Supplier Management, Legal, Data Protection Engineering, and business stakeholders to gather the information needed to complete assessments and close third-party data-sharing gaps

• Continuously build proficiency with industry-recognized risk assessment tools, third-party risk frameworks, and the team’s assessment methodologies, and seek out mentorship from senior engineers to grow technical and domain expertise

• Conduct root-cause analysis on data-quality issues or defects in third-party records and assessment workflows, and implement fixes under senior engineer guidance

• Support the team’s roadmap by helping execute the underlying inventory, assessment, and reassessment work that feeds more advanced capabilities such as risk-based intake and continuous risk assessment

• Actively seek and apply feedback from teammates and senior engineers, share knowledge with the team, and help teammates work through obstacles and blockers when asked

Qualifications:

• Experience conducting risk or security assessments, or supporting reassessment/renewal processes, in a cybersecurity, IT risk, or vendor/third-party risk context

• Experience working with GRC, TPCRM, or workflow platforms (e.g., industry-recognized risk assessment tools, Archer, ServiceNow) to execute or track assessments, issues, or records

• Experience reconciling data across multiple systems and identifying/resolving data-quality gaps

• Working knowledge of cybersecurity and data-privacy regulations and standards relevant to third-party risk (e.g., NYDFS, NIST CSF)

• Familiarity with data security and third-party risk frameworks and protocols, such as ISO 27001, NIST, and CIS

• Strong analytical and problem-solving skills, with the ability to execute well-defined tasks reliably and escalate ambiguous issues to senior engineers

• Strong written and verbal communication skills, with the ability to build working relationships with teammates and cross-functional stakeholders such as Supplier Management and Legal

• A proactive, detail-oriented approach to high-volume, deadline-driven work, along with a willingness to seek mentorship and feedback to grow technical and domain expertise

One or more of the following cybersecurity certifications are highly desired:

• CompTIA Security+ (Sec+)

• CompTIA Cybersecurity Analyst+ (CYSA+)

• One or more of the following cybersecurity certifications are highly encouraged:

• Certified Information Systems Security Professional (CISSP)

• Certified Information Security Manager (CISM)

• Certified in Risk and Information Systems Control (CRISC)

• Certified Third-Party Risk Professional (CTPRP)

Experience:

• 1-2+ years of experience in cybersecurity, IT risk, or third-party/vendor risk management

• Experience with GRC/TPRM or workflow platforms (e.g., OneTrust, Archer, ServiceNow), or comparable ticketing/case-management tools, preferred 

• Experience with data reconciliation, reporting, or dashboarding tools (e.g., Excel, Power BI, SQL) preferred 

• Familiarity with cloud environments (AWS, GCP, or Azure) a plus 

Education:

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or equivalent education or work experience 

Annual Salary

The above annual salary range is a general guideline. Multiple factors are taken into consideration to arrive at the final hourly rate/ annual salary to be offered to the selected candidate. Factors include, but are not limited to, the scope and responsibilities of the role, the selected candidate’s work experience, education and training, the work location as well as market and business considerations.

The GEICO Pledge:

Great Company: Protecting customers through life’s twists and turns with innovation and integrity.

Great Careers: Personalized development programs, mentorship, and certification assistance.

Great Culture: Inclusive and collaborative culture rooted in shared success.

Great Rewards: Competitive pay, benefits, and flexibility to support your well-being and future.

The equal employment opportunity policy of the GEICO Companies provides for a fair and equal employment opportunity for all associates and job applicants regardless of race, color, religious creed, national origin, ancestry, age, gender, pregnancy, sexual orientation, gender identity, marital status, familial status, disability or genetic information, in compliance with applicable federal, state and local law. GEICO hires and promotes individuals solely on the basis of their qualifications for the job to be filled.

GEICO reasonably accommodates qualified individuals with disabilities to enable them to receive equal employment opportunity and/or perform the essential functions of the job, unless the accommodation would impose an undue hardship to the Company. This applies to all applicants and associates. GEICO also provides a work environment in which each associate is able to be productive and work to the best of their ability. We do not condone or tolerate an atmosphere of intimidation or harassment. We expect and require the cooperation of all associates in maintaining an atmosphere free from discrimination and harassment with mutual respect by and for all associates and applicants.