Estrada Consulting Incorporated
Senior Cybersecurity, Privacy & Resilience Assessment Lead (Ref #: 1121346)
Nantucket, Massachusetts•Contract
$60 - $70 hourly
$60 - $70 hourly
About the Job
Estrada Consulting, Inc. is seeking a Senior Cybersecurity, Privacy & Resilience Assessment Lead to perform an independent cybersecurity risk and organizational resilience assessment for a municipal government technology environment.
Location: Remote / Hybrid – Nantucket, MA
Project Duration: Approximately 120 days, anticipated January–May 2027
Work Arrangement: Remote work with required onsite assessment visits to Nantucket Island.
Position Overview:
The selected consultant will lead an evidence-based cybersecurity and resilience assessment aligned with the NIST Cybersecurity Framework (CSF) 2.0 or equivalent recognized standards. The consultant will evaluate cybersecurity governance, technical controls, privacy obligations, incident response, business continuity, and disaster recovery capabilities.
The role will identify risks and control gaps and develop practical remediation recommendations that support enterprise-wide technology governance and strategic planning.
Key Responsibilities:
- Lead a cybersecurity risk assessment using NIST CSF 2.0, including Govern, Identify, Protect, Detect, Respond, and Recover functions.
- Evaluate cybersecurity policies, risk management practices, security governance, and accountability structures.
- Assess identity and access management, multifactor authentication, privileged access, and security controls.
- Review vulnerability management, patch management, logging, monitoring, and threat detection capabilities.
- Evaluate incident response procedures, escalation processes, cybersecurity preparedness, and recovery capabilities.
- Review backup strategies, business continuity plans, disaster recovery arrangements, and recovery dependencies.
- Assess relevant data privacy and regulatory obligations, including CJIS, HIPAA, FERPA, and applicable state requirements.
- Evaluate third-party and supplier cybersecurity risks, including shared technology dependencies.
- Document current and target cybersecurity maturity, control gaps, risk exposure, and recommended remediation activities.
- Develop a prioritized cybersecurity risk register with recommendations, estimated effort, and implementation sequencing.
- Coordinate with infrastructure and applications specialists regarding technical dependencies, data protection, and AI-related security risks.
- Contribute to executive-level assessment reports, governance recommendations, and the multi-year IT strategic roadmap.
Required Qualifications:
- Demonstrated experience conducting enterprise cybersecurity risk assessments and security control reviews.
- Strong working knowledge of NIST CSF, cybersecurity governance, risk management, and security assessment methodologies.
- Experience evaluating identity management, vulnerability management, incident response, business continuity, and disaster recovery.
- Ability to assess security policies, technical controls, and organizational cybersecurity practices.
- Experience documenting cybersecurity findings, risk registers, remediation recommendations, and executive reports.
- Strong analytical, interviewing, technical writing, and stakeholder communication skills.
- Ability to translate technical cybersecurity risks into practical recommendations for organizational leadership.
- Availability for required onsite work in Nantucket, Massachusetts.
Preferred Qualifications:
- CISSP, CISA, CISM, or comparable cybersecurity certification.
- Experience conducting cybersecurity assessments for municipalities, counties, public safety organizations, or other government entities.
- Familiarity with CJIS, HIPAA, FERPA, and public-sector privacy and security requirements.
- Experience with NIST CSF 2.0 Current and Target Profiles, ISO 27001, or COBIT.
- Experience assessing cybersecurity governance across multiple departments or independently operated entities.
Work Location and Travel Requirements:
This position is primarily remote with mandatory onsite assessment work on Nantucket Island. Candidates must be available for two separate onsite periods of approximately two weeks each, anticipated during project Weeks 3–4 and Weeks 9–11. Exact schedules will be coordinated with the project team. Candidates are not required to reside on Nantucket.