About the role
Overview
The Security Controls Oversight, Risk & Evaluation (SCORE) team is responsible for evaluating risk, validating control effectiveness, and delivering actionable insights that help Security leaders manage risk, meet regulatory expectations, and improve business outcomes. Through risk & control self assessments (RCSA), controls testing, reporting, and emerging AI-enabled capabilities, the team serves as a strategic business partner focused on advancing risk maturity, operational excellence, and informed decision-making across the Security organization.
The Summer Associate Program is a 12-week internship program beginning in May 2027 and ending in August 2027. Students will work on impactful projects and meaningful work during their internship. To qualify for this position, applicants must be currently pursuing a degree from an accredited college or university and have an anticipated graduation date of December 2027 or later.
Potential Projects
Risk & Control Process Modernization (AI and Automation) - Evaluate current risk & control identification and controls testing activities to identify repetitive, time-intensive tasks that could benefit from AI-assisted capabilities. Develop a prioritized roadmap of AI use cases focused on improving productivity, quality, consistency, and analyst capacity.
Reporting & Metrics Enhancement - Inventory SCORE reporting products and performance metrics to determine which measures effectively support decision-making and which create unnecessary effort. Recommend a future-state reporting framework that improves data quality, transparency, automation, and leadership visibility.
Process Rationalization & Risk Mapping - Evaluate relationships between Security processes, risks, controls, standards, and regulatory requirements to improve traceability and reduce complexity. Produce a consolidated mapping model that supports process rationalization, risk coverage analysis, and future governance activities.
Cross-function Shadowing - Shadow staff and leaders from other Security, Governance, and Risk functions to gain visibility into cross-team enterprise efforts such as issues management, incident management, and leadership reporting.
Responsibilities
Support Risk & Control Identification and Assessment (RCIA) workshops and RCSA activities by documenting process information, risks, controls, and assessment outcomes.
Assist with the review and analysis of process documentation, narratives, procedures, and process maps to identify potential risks and control opportunities.
Participate in security control testing activities by collecting, organizing, and reviewing evidence under the supervision of testing personnel.
Assist with documenting test procedures, test results, observations, and supporting workpapers.
Perform data analysis and validation to support risk assessments, control evaluations, and reporting activities.
Support the maintenance of risk and control inventories within governance, risk, and compliance (GRC) systems.
Assist with tracking action items, issues, remediation efforts, and testing milestones.
Create executive-ready summaries, presentations, and status reporting materials for management review.
Research regulatory requirements, industry standards, and leading practices related to operational risk, information security, and controls management.
Collaborate with risk managers, control testers, process owners, and business stakeholders to support ongoing assessment and governance activities.
Participate in team meetings, project discussions, and training opportunities to gain exposure to enterprise risk management practices.
Perform other duties as assigned.
Qualifications
Currently enrolled in an accredited college or university pursuing a Bachelor's or Master's degree in: Information Security/Cybersecurity, Computer Information Systems, Information Technology, Risk Management, Accounting, or a related field.
Strong analytical and problem-solving skills.
Effective verbal and written communication skills.
Ability to gather, organize, and analyze information from multiple sources.
Proficiency with Microsoft Office products, including Excel, Word, PowerPoint, and Teams.
Desired Qualifications
Coursework or experience in risk management, audit, compliance, cybersecurity, information assurance, or internal controls.
Familiarity with risk assessment frameworks or control frameworks such as NIST, FFIEC, ISO 27001, COBIT, or COSO.
Experience using data analysis tools such as Excel, Power BI, SQL, or similar technologies.
Understanding of governance, risk, and compliance (GRC) concepts.
Interest in pursuing careers in cybersecurity, risk management, internal audit, compliance, or security governance.
Additional Information
Hours
Monday - Friday, 8:00 AM - 4:30 PM
Location
820 Follin Lane, Vienna, VA 22180
5550 Heritage Oaks Drive, Pensacola, FL 32526
141 Security Drive, Winchester, VA 22602
About Us
Navy Federal provides much more than a job. We provide a meaningful career experience, including a culture that is energized, engaged and committed; and fierce appreciation for our teams, who are rewarded with highly competitive pay and generous benefits and perks.
Our approach to careers is simple yet powerful: Make our mission your passion.
• FORTUNE 100 Best Companies to Work For® 2026
• Yello and WayUp Top 100 Internship Programs 2025
• Computerworld® Best Places to Work in IT 2026
• Most Loved Workplace - America's Top Most Loved Workplaces® 2025
• 2025 PEOPLE® Companies That Care
• Newsweek Most Trustworthy Companies in America 2026
• Military Times 2025 Best for Vets Employers
• Forbes® 2026 America's Best Large Employers
• Forbes® 2025 America's Best Employers for New Grads
• Forbes® 2025 America's Best Employers for Tech Workers
• 2025 RippleMatch Campus Forward Award Winner for Overall Excellence
• Military.com Top Military Spouse Employers 2025
• 2026 Handshake Early Talent Award
• Newsweek America's Greatest Workplaces for Culture, Belonging and Community 2026
From Fortune Magazine. © 2026 Fortune Media IP Limited. All rights reserved. Used under license. Fortune and Fortune 100 Best Companies to Work For are registered trademarks of Fortune Media IP Limited and are used under license. Fortune Magazine, Fortune Media (USA) Corporation, and its affiliates are not affiliated with, and do not endorse products or services of, Navy Federal Credit Union.
Equal Employment Opportunity: All qualified applicants will receive consideration for employment without regard to age, race, sex, color, religion, national origin, disability, veteran status, pregnancy, sexual orientation, genetic information, gender identity or any other basis protected by applicable law.
Accommodations: If you need accommodation or assistance for a qualifying condition to complete the online application (or during any stage of the hiring process), you can contact Navy Federal's Medical Accommodations team at medicalaccommodations@navyfederal.org or by calling 1-888-503-6013. This team cannot provide any information on job postings or application status.
Disclaimers: Navy Federal reserves the right to fill this role at a higher/lower grade level based on business need. An assessment may be required to compete for this position. Job postings are subject to close early or extend out longer than the anticipated closing date at the hiring team's discretion based on qualified applicant volume. Navy Federal Credit Union assesses market data to establish salary ranges that enable us to remain competitive. You are paid within the salary range, based on your experience, location and market position. For additional details regarding compensation and benefits, review the Benefits page of the Navy Federal Career Site.
Protect Yourself from Job Scams: Navy Federal Credit Union jobs are posted on our career site, jobs.navyfederal.org and reputable job boards (e.g., LinkedIn, Indeed). We do not post jobs on social media marketplaces, messaging apps or unverified websites. We will never ask candidates for payment, bank details or personal financial information during the hiring process.
Bank Secrecy Act: Remains cognizant of and adheres to Navy Federal policies and procedures, and regulations pertaining to the Bank Secrecy Act.