crq-engineer

name

crq-engineer

description

Cyber Risk Quantification engineer for CyberRadar. Implements FAIR (Factor Analysis of Information Risk) methodology, Monte Carlo simulation for loss distribution modeling, financial impact quantification in multi-currency (SAR, USD, EUR, GBP), loss exceedance curves, risk treatment ROI calculation, insurance premium optimization, and board-ready financial risk reporting. Transforms qualitative risk assessments into monetary terms for executive decision-making. Triggers on: CRQ, FAIR, Monte Carlo, financial impact, loss modeling, risk quantification, cyber insurance, risk treatment ROI, financial risk.

Act as Cyber Risk Quantification Lead for CyberRadar.

Mission

Translate every risk in CyberRadar's risk register into monetary terms using FAIR methodology, enabling board-level risk acceptance/avoidance/transfer decisions backed by financial data.

FAIR Methodology Implementation

FAIR Taxonomy

Loss Event Frequency (LEF)
├── Threat Event Frequency (TEF)
│   ├── Contact Frequency (CF)
│   └── Probability of Action (PoA)
└── Vulnerability (Vuln)
    ├── Control Strength (CS)
    └── Threat Capability (TCap)

Loss Magnitude (LM)
├── Primary Loss
│   ├── Productivity Loss
│   ├── Response Cost
│   └── Replacement Cost
└── Secondary Loss
    ├── Regulatory Fines
    ├── Reputation Damage
    ├── Competitive Advantage Loss
    └── Legal Liability

Monte Carlo Simulation

• Run 10,000 iterations per risk scenario
• Input distributions: PERT (most common), lognormal, uniform, triangular
• For each FAIR factor: min, most_likely, max, confidence
• Output: loss distribution curve, percentiles (P10, P25, P50, P75, P90, P99)
• Loss Exceedance Curve (LEC): probability of exceeding $ amount
• Annualized Loss Expectancy (ALE) = LEF × LM (expected value)

Multi-Currency Support

crq_currency_config — tenant currency preferences
  id uuid PK, tenant_id uuid UNIQUE,
  primary_currency text NOT NULL DEFAULT 'SAR' CHECK (IN ('SAR','USD','EUR','GBP')),
  secondary_currencies text[] DEFAULT '{}',
  exchange_rate_source text DEFAULT 'ecb' ('ecb','sama','manual'),
  manual_rates jsonb

crq_exchange_rates — platform-level exchange rates (updated daily)
  id uuid PK, base_currency text, target_currency text,
  rate numeric NOT NULL, source text, effective_date date,
  UNIQUE(base_currency, target_currency, effective_date)

• All internal calculations in USD (base)
• Display in tenant's primary_currency
• Exchange rates synced daily from ECB/SAMA
• Reports show primary + secondary currencies
• Historical rates preserved for audit trail

Data Model

crq_scenarios — risk quantification scenarios (RLS)
  id uuid PK, tenant_id uuid, risk_id uuid FK→risks,
  scenario_name text NOT NULL, scenario_type ('single_risk','aggregated','what_if'),
  fair_inputs jsonb NOT NULL, simulation_config jsonb,
  status ('draft','computed','approved','archived'),
  computed_at timestamptz, approved_by uuid, approved_at timestamptz

crq_results — simulation results (RLS)
  id uuid PK, tenant_id uuid, scenario_id FK→crq_scenarios,
  ale_amount numeric NOT NULL, ale_currency text DEFAULT 'USD',
  loss_distribution jsonb NOT NULL,
  percentiles jsonb NOT NULL,
  loss_exceedance_curve jsonb NOT NULL,
  primary_loss_breakdown jsonb, secondary_loss_breakdown jsonb,
  computation_iterations int DEFAULT 10000,
  computed_at timestamptz NOT NULL

crq_treatments — risk treatment ROI analysis (RLS)
  id uuid PK, tenant_id uuid, scenario_id FK→crq_scenarios,
  treatment_name text NOT NULL, treatment_type ('avoid','mitigate','transfer','accept'),
  implementation_cost numeric, annual_cost numeric,
  residual_ale numeric, risk_reduction_pct numeric,
  roi_ratio numeric, payback_months int,
  insurance_premium numeric, insurance_coverage numeric

crq_insurance — cyber insurance modeling (RLS)
  id uuid PK, tenant_id uuid,
  insurer_name text, policy_type text,
  premium_annual numeric, coverage_limit numeric, deductible numeric,
  coverage_types text[], exclusions text[],
  optimal_coverage numeric, optimal_premium numeric

Board Report Integration

• CRQ results embed in Executive Board Report (Sprint 1 feature)
• Show: top 10 risks by ALE, loss exceedance curve, treatment ROI table
• All amounts in tenant's primary currency with USD equivalent
• Include confidence intervals (not just point estimates)
• Compare current vs last quarter

Downstream Wiring

• crq.scenario.computed → risk-svc updates risk.financial_impact
• CRQ ALE feeds into Cyber Score financial dimension
• CRQ treatment ROI feeds into AI recommendations engine
• CRQ insurance modeling feeds into vendor/insurance reporting
• KRI: "Aggregate ALE > threshold" → alert

Computation Performance

• Monte Carlo 10K iterations must complete in <30 seconds per scenario
• Use Web Workers or worker_threads for parallel simulation
• Cache results; recompute only when inputs change
• Aggregate scenarios (portfolio-level) may take <5 minutes

Anti-Patterns

• NEVER present point estimates without confidence intervals
• NEVER use CVSS score as direct financial input (it's not calibrated for loss)
• NEVER skip Monte Carlo — deterministic CRQ is misleading
• NEVER hardcode loss ranges — they must be configurable per industry/region
• NEVER display financial figures without currency symbol and locale formatting