Role Description Koniag IT Systems, LLC, a Koniag Government Services company, is seeking an experienced ICAM Risk & Quality Manager to join a team supporting Identity, Credential, and Access Management (ICAM) solutions for our government customers. The ideal candidate is a seasoned professional with a strong background in risk management, quality assurance, and identity and access management frameworks within a federal environment. This individual will play a critical role in ensuring integrity, compliance, and continuous improvement of ICAM programs and processes. The ICAM Risk & Quality Manager will be responsible for overseeing risk management activities, quality assurance processes, and compliance efforts associated with ICAM programs and solutions in a federal government environment. This individual will work closely with program managers, security teams, engineers, and government stakeholders to identify, assess, and mitigate risks while ensuring that ICAM deliverables and operations meet the highest standards of quality and compliance. - Develop, implement, and manage a comprehensive risk management framework for ICAM programs, including the identification, assessment, prioritization, and mitigation of risks across people, processes, and technology. - Establish and maintain a quality management program for ICAM operations, ensuring that all deliverables, processes, and services meet defined quality standards and government requirements. - Conduct regular risk assessments and quality audits of ICAM systems, processes, and configurations to identify vulnerabilities, gaps, and areas for improvement. - Develop and maintain a Risk Register, tracking identified risks, mitigation strategies, residual risks, and risk owners throughout the program lifecycle. - Collaborate with ICAM engineers, administrators, and program managers to ensure risk mitigation strategies are effectively implemented and monitored. - Support the development and maintenance of program policies, procedures, and standards aligned with federal ICAM frameworks, NIST guidelines, and Zero Trust principles. - Lead and coordinate internal quality reviews, process audits, and after-action reviews to drive continuous improvement across ICAM operations. - Prepare and present risk and quality reports, dashboards, and briefings to government stakeholders and program leadership on a regular basis. - Support the Authority to Operate (ATO) process by contributing to and reviewing security documentation, including System Security Plans (SSPs), Risk Assessment Reports (RARs), and Plans of Action and Milestones (POA&Ms). - Coordinate with security and compliance teams to ensure ICAM solutions adhere to relevant federal regulations, policies, and standards, including FISMA, FedRAMP, NIST SP 800-53, and FICAM. - Monitor and track POA&Ms to ensure timely remediation of identified risks and findings. - Serve as a subject matter expert (SME) on ICAM risk and quality matters, providing guidance and recommendations to technical teams and stakeholders. - Facilitate training and awareness activities related to ICAM risk management and quality assurance practices. - Support incident response efforts related to ICAM systems by assessing risk impact and contributing to lessons-learned reviews. - Develop and maintain metrics and key performance indicators (KPIs) to measure the effectiveness of risk management and quality assurance activities. Qualifications - Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Risk Management, or a related field from an accredited college or university; equivalent work experience may be considered in lieu of a degree. - 5+ years of experience in risk management, quality assurance, or compliance roles within an information technology or cybersecurity environment. - 3+ years of experience working with ICAM programs, frameworks, or technologies in a federal government context. Requirements - Exceptional communication skills in English – both written and oral – with the ability to communicate effectively with both technical and non-technical stakeholders, including senior government leadership. - Strong understanding of risk management frameworks and methodologies, including NIST Risk Management Framework (RMF), NIST SP 800-30, and NIST SP 800-53. - Demonstrated experience developing and maintaining Risk Registers, POA&Ms, and risk assessment reports in a federal IT environment. - Familiarity with ICAM frameworks, principles, and federal identity management standards, including FICAM, NIST SP 800-63, and Zero Trust Architecture. - Experience supporting or leading ATO processes, including the preparation and review of security documentation such as SSPs, RARs, and POA&Ms. - Knowledge of federal compliance and regulatory requirements, including FISMA, FedRAMP, and OMB policies related to identity and access management. - Experience developing, implementing, and managing quality management programs and conducting process audits and reviews. - Strong analytical and problem-solving skills, with the ability to assess complex risks and develop practical, actionable mitigation strategies. - Ability to develop and present clear, concise risk and quality reports and briefings to diverse audiences, including senior leadership and government customers. - Proficiency in developing and tracking metrics and KPIs to measure program health and effectiveness. - Demonstrated ability to manage multiple priorities and work effectively in a fast-paced, team-oriented environment. Benefits - Competitive compensation. - Extraordinary benefits package including health, dental, and vision insurance. - 401K with company matching. - Flexible spending accounts. - Paid holidays. - Three weeks paid time off. - And more.

• Review TMS cases against established QA rubrics, including core sampling for regulatory filings (SARs) and risk-based sampling across priority compliance areas. • Lead calibration sessions, office hours, and structured analyst support to drive consistency and deepen understanding of complex procedural requirements. • Conduct root cause analysis on thematic quality issues and translate findings into actionable recommendations for process, training, and procedural updates. • Partner with second line of defense stakeholders and deliver timely, well-supported responses to review and audit findings. • Build and present weekly metrics, dashboards, and trend analyses that highlight risks, performance themes, and improvement opportunities to senior stakeholders. • Train new joiners, validate practice cases, and provide structured feedback to accelerate analyst readiness and quality performance.

Role Description We are looking for an absolute doer, not a delegator. Reporting to the Head of Risk, this is an individual contributor role where you will operate essentially as a one-person ERM team. If you are looking to sit in a Second Line ivory tower, review other people’s work, and write high-level policy memos, this is not the role for you. In our lean, fast-scaling environment, you must have the willingness and capability to completely roll up your sleeves and own the entire risk lifecycle from A to Z. You are the Stage 1 triager who drops everything to dive into messy data, investigate real-time incidents, and cut through noise to diagnose what is broken. Simultaneously, you are the Stage 2 builder who executes the actual grunt work required to fix it—writing the risk registers, configuring the tracking tools, co-designing automated controls with engineers, and building your own executive slide decks. We want a gritty, highly technical creator who treats risk as an operational engineering problem and leverages AI and automation to scale themselves, ensuring that a lean infrastructure can punch way above its weight. Qualifications - Bachelor’s degree in Business Administration, Finance, Economics, Law, or a related field. Relevant certifications (e.g., FRM, PRM, CRISC, or CRMA) are a plus. - 7–10 years of progressive, hands-on experience in enterprise risk management, internal audit, or compliance — including direct experience designing risk frameworks, performing risk assessments, and executing Second Line monitoring and challenge activities. - Ability to drive execution through cross-functional influence, operating effectively as an individual contributor in the Second Line — overseeing rather than performing First Line activities. - Solid understanding of the crypto and blockchain ecosystem, digital assets, and their unique risk profiles (e.g., custody models, Layer 1/Layer 2 architectures, DeFi primitives, stablecoin dynamics). - Track record working within a regulated financial, banking, or digital asset environment; familiarity with NYDFS, SEC, MiCA, or comparable regulatory regimes preferred. - Working knowledge of counterparty risk assessment, market and liquidity risk concepts, and operational risk frameworks. - A builder/creator orientation — energized by designing and improving processes rather than administering them. Curious, resourceful, and willing to prototype, automate, and iterate. - Demonstrated interest in (and ideally hands-on use of) AI tools, agentic workflows, and automation to make risk and control work faster, sharper, and more data-driven. - A hard focus on continuous improvement in how risks are tracked, validated, and remediated — challenges status quo, identifies friction, and proposes better approaches. - Proven ability to support strategic change initiatives, navigate resistance, and drive cultural alignment around risk management principles. - Strong stakeholder management and executive presence, with the ability to articulate complex risk scenarios to non-technical audiences, the Head of Risk, the Board, and regulators. Requirements - Design, implement, and continuously improve the Enterprise Risk Management framework, risk taxonomy, risk registers, and risk appetite statements specific to digital assets and regulated financial services. - Provide strategic direction for risk mitigation and operational improvement initiatives, guiding them from conception through completion in partnership with First Line business owners. - Validate the design and implementation of sustainable controls established by the First Line to address identified risks, audit findings, and compliance gaps. - Maintain and evolve risk policies, standards, and procedures aligned with regulatory expectations (including NYDFS) and industry best practices. - Oversee and drive risk mitigation efforts related to counterparty exposure, including the assessment and ongoing monitoring of institutional partners, custodians, market makers, and liquidity providers. - Support business-centric risk initiatives across market risk, liquidity risk, and operational risk — providing Second Line challenge and guidance to First Line owners. - Partner with business and product teams on the risk-clearing process for new product launches, token listings, and partner integrations, providing independent Second Line review. - Conduct enterprise-wide risk assessments across financial, operational, strategic, and technological domains — including crypto-specific risks such as custody, stablecoin peg stability, and on-chain exposure — to evaluate enterprise risk levels. - Monitor emerging risks (regulatory, market, technology, and cyber) and provide early warning and recommended actions to the Head of Risk and executive team. - Oversee and drive risk mitigation tied to audit findings, regulatory exam observations, and self-identified issues, holding First Line owners accountable for execution and sustainability. - Validate the design and implementation of remediation actions, track progress to closure, and report status to leadership and the Risk Committee of the Board. - Lead change management associated with ERM transformations, supporting smooth adoption of new risk policies, frameworks, and systems across the enterprise. - Partner with department heads, Legal, Compliance, Internal Audit, Finance, and Technology/Product teams to coordinate effective risk strategies — driving execution through cross-functional influence rather than direct ownership of First Line controls. - Embrace AI and agentic workflows to increase the speed, accuracy, and scalability of Second Line activities — including risk assessments, control validation, issue tracking, and reporting. - Maintain a hard focus on continuous improvement in how risks are identified, escalated, tracked, validated, and remediated — challenging legacy approaches and removing manual friction wherever possible. - Identify, evaluate, and help operationalize new tools, automations, and data-driven approaches to risk monitoring; partner with Technology, Data, and First Line teams to bring them to life. - Operate as a builder and creator — designing better ways of working, prototyping improvements, and measurably raising the bar over time — rather than administering existing processes for their own sake. - Prepare risk reporting, analysis, and materials in support of the Head of Risk, who serves as the primary interface to executive leadership, the Risk Committee of the Board, and regulators (including NYDFS). - Translate complex risk scenarios into clear, actionable insights for technical and non-technical audiences. Benefits - Equal opportunity employer committed to diversity in the workforce. - Must successfully pass a post-offer background check and drug screen.

Role Description The position will be primarily responsible for assessing the information security posture of key clients’ third parties and coordinating the overall execution and delivery of assessments. The position will work within a Crowe team at a client or third party site and be responsible for leading the effort to identify key risks and information security gaps. Specific projects may include: - Conducting Third Party Risk Assessments by evaluating third party questionnaire responses, performing control validation, and assessment of documentation per established procedures and standards - Performing site visits to third-party facilities - Evaluating the effectiveness of security controls for compliance with applicable policies, security laws, and regulations - Assessing cloud technologies such as Software as a Service (SaaS) hosted applications, Platform as a Service (PaaS), and Infrastructure as a Service deployments (IaaS) - Documenting information security risk and compliance findings and recommendations for remediation - Performing quality assurance and review of assessments performed by other team members - Delivering high quality, thorough reports - Coordinating the schedules and assessments for key third party clients and overseeing all key deliverables Qualifications - Bachelor's Degree - Information Technology and/or Cybersecurity background and/or experience, including 2-4 years IT experience with network, platform, and/or application technology - Willingness to obtain the Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), or Certified Third Party Risk Assessor (CTPRA) designations - Knowledge of security areas such as auditing, policy, database security, firewall design and implementation, risk analysis, identity management, access management, or web - Working knowledge of at least one compliance framework, such as SOC2, ISO 27001, NIST, HIPAA - Experience managing multiple projects, in a fast-paced environment - Proven ability to learn new technologies and systems, especially through independent research and self-study - Ability to communicate technical information verbally and through written documentation - Ability to manage project schedules and client expectations - Ability to travel domestically an average of 20%-50% per year Requirements - Bachelors and/or advanced degree with a concentration in: Cybersecurity, Risk Management, Computer Science, or Management Information Systems - Any experience working with or assessing third party vendors is preferred but not required - IT experience at a leading industry public company. This might include either IT auditing or being a member of an IT or Cybersecurity team - Experience with Archer, Process Unity, ServiceNow or other GRC/VRM tools - Experience with security ratings platforms - Bilingual - Open to remote Benefits - Your exceptional people experience starts here. At Crowe, we know that great people are what makes a great firm. We care about our people and offer employees a comprehensive total rewards package. - We will nurture your talent in an inclusive culture that values diversity. You will have the chance to meet on a consistent basis with your Career Coach that will guide you in your career goals and aspirations.