Risk Analyst

Risk AnalystLocation: Deerfield, IL | RemoteAt Alera Group, our corporate teams play a critical role in supporting the success of colleagues and clients across the country. From Human Resources and Finance to Technology, Legal, Marketing, and Operations, these professionals ensure our organization runs efficiently while enabling our teams to deliver exceptional service.Founded in 2017, Alera Group has grown to become the 14th largest broker of U.S. business. We are passionate about our clients' success in Employee Benefits, Property & Casualty Insurance, and Financial Services. With offices nationwide, our collaborative approach allows us to deliver national strength with local service.We are always looking to connect with talented professionals who want to contribute to a collaborative, high-growth environment and help drive strategic initiatives across a national organization.Collaborate with purpose – Work alongside colleagues who believe the best results come from strong partnerships, shared expertise, and supporting one another.Build your career – Expand your expertise through meaningful work, continuous learning, and opportunities to grow across a national organization.Make an impact – Help clients navigate complex challenges while contributing to solutions that make a difference for their businesses, employees, and communities.Perform third-party security and compliance risk assessments for new and existing vendors, evaluating risk exposure, control effectiveness, business impact, and remediation requirementsReview SOC reports, security questionnaires, audit documentation, certifications, and other evidence to identify control gaps and potential business impactsCoordinate and execute user access reviews, validating access appropriateness and ensuring identified issues are remediated promptlyDocument risks, findings, recommendations, and remediation plans while maintaining accurate records within governance, risk, and compliance platformsServe as a trusted advisor to stakeholders by asking thoughtful questions, identifying underlying business needs, assessing potential risks, and translating ambiguous requests into clear risk assessment, governance, and compliance activitiesPartner with Information Security, Technology, Legal, Procurement, and business stakeholders to identify requirements, resolve risk and compliance issues, and drive effective risk-based decision-makingSupport internal and external audits, regulatory examinations, and compliance activities through evidence collection and documentation managementDevelop risk metrics, reporting, and dashboards that drive visibility, support decision-making, and measure the effectiveness of third-party risk and governance programsIdentify opportunities to improve risk management processes, controls, reporting, governance practices, and automation capabilitiesRequired Qualifications5+ years of experience in cybersecurity risk, IT risk, information security, governance, risk and compliance (GRC), third-party risk, IT audit, or a related fieldHands-on experience performing third-party or vendor security risk assessmentsExperience coordinating or performing user access reviews, access certifications, or identity governance activitiesFamiliarity with cybersecurity and compliance frameworks such as NIST CSF, SOC 2, CIS Controls, HIPAA, or similar standardsStrong analytical, critical thinking, and communication skills with the ability to evaluate complex situations, identify underlying business and risk requirements, and effectively communicate recommendations to both technical and non-technical audiencesExperience working with GRC, ticketing, identity governance, or third-party risk management platformsExercise sound judgment when evaluating risk scenarios, identifying gaps in information, and determining appropriate next steps, stakeholders, and remediation activitiesCertificationsCISA, CGRC or equivalent preferredPreferred QualificationsExperience within a regulated industry such as insurance, financial services, or healthcareExperience supporting SOC 2, HIPAA, NYDFS, or similar regulatory and compliance programsExperience with automated identity governance, access certification, or third-party risk management solutionsExperience supporting internal or external security and compliance auditsAbility to independently research requirements, develop risk-based recommendations, and communicate findings to stakeholdersDemonstrated ability to gather and clarify ambiguous requirements, ask effective probing questions, and develop practical risk-based solutions in collaboration with business stakeholdersSalary Range: $87,000 - $110,000 annuallyBonus Eligible: YesEligible colleagues enjoy a comprehensive benefits package including:Medical, dental, and vision insuranceLife and disability coverage401(k)Generous paid time offProfessional development and career growth opportunitiesWork Model: This role is RemotePreference for Central or Eastern Time ZoneProfessional Development – Alera Group AcademyAt Alera Group, growth isn't left to chance. Through Alera Group Academy, we provide structured development opportunities designed to help you expand your expertise and build a meaningful career.You'll have access to:Role-specific learning pathsLeadership development programsTechnical and compliance trainingIndustry certifications and continuing education supportPeer learning and knowledge-sharing communitiesWhether you're deepening technical expertise or preparing for leadership, we're invested in helping you grow.We're an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status, or any other protected class.Alera Group is committed to protecting your privacy. Please review our Privacy Policy to understand what personal information we may collect and use as part of your application process.Location TypeHybrid - 2 or less days in office