Cybersecurity Sr. Risk Analyst

Job Description

Title: Cybersecurity Sr. Risk Analyst / ServiceNow Business Analyst

Location: Abbott Park, IL

Duration: 12 Months with possible extension

Only W2 candidates are eligible for this position. Third-party or C2C candidates will not be considered.

Job Description

\n
• We are seeking a highly skilled Cybersecurity Sr. Risk Analyst / ServiceNow Business Analyst with a unique blend of cybersecurity risk management expertise, ServiceNow platform experience, and strong business analysis capabilities. The ideal candidate will possess demonstrated experience translating business requirements into actionable solutions, developing business use cases, documenting functional requirements, coordinating user acceptance testing (UAT), and driving platform enhancements from concept through implementation.
\n
• The successful candidate will have a strong understanding of Governance, Risk, and Compliance (GRC) principles and frameworks, coupled with the ability to analyze business processes, identify opportunities for improvement, and support the optimization of risk management workflows through technology-enabled solutions. This role requires a strategic thinker who can bridge the gap between cybersecurity, business stakeholders, and technical teams to drive informed risk-based decisions and continuous process improvement.
\n
• As a member of the Cybersecurity Vendor Risk Management team, this role will evaluate and monitor third-party risks while serving as a key liaison between business stakeholders and technology teams. Responsibilities include gathering and documenting business requirements, developing detailed use cases and process flows, managing enhancement requests, supporting system configuration and testing activities, and ensuring risk management processes are effectively supported through enterprise platforms and tools.
\n

Key Responsibilities

\n
• Evaluate, assess, and monitor cybersecurity and third-party risk activities in alignment with organizational risk management objectives.
\n
• Partner with business stakeholders to gather, analyze, and document business requirements for risk management processes and technology solutions.
\n
• Develop business use cases, user stories, process maps, and functional requirements to support cybersecurity and GRC initiatives.
\n
• Manage and prioritize enhancement requests, ensuring business needs are clearly documented and translated into actionable development requirements.
\n
• Coordinate and execute system testing activities, including test strategy development, test script creation, user acceptance testing (UAT), defect tracking, and validation of implemented solutions.
\n
• Collaborate with technical teams to support solution design, implementation, and deployment activities.
\n
• Analyze existing workflows and identify opportunities to improve operational efficiency, data quality, automation, and user experience.
\n
• Act as a liaison between cybersecurity teams, business stakeholders, and technology partners to ensure successful delivery of enhancements and process improvements.
\n
• Support data governance and stewardship activities to ensure the integrity, accuracy, and consistency of information used in risk management processes.
\n
• Develop metrics, reporting, and dashboards to provide visibility into risk posture, operational performance, and program effectiveness.
\n
• Participate in risk assessments, control evaluations, and remediation tracking activities.
\n
• Prepare business and technical documentation, including requirements, testing artifacts, training materials, and process documentation.
\n
• Support audit, compliance, and regulatory activities by providing documentation and evidence related to cybersecurity risk management processes and system controls.
\n

Preferred Qualifications

\n
• Demonstrated experience as a ServiceNow Analyst, Business Analyst, or Product Owner supporting enterprise workflows and business process improvements.
\n
• Strong understanding of cybersecurity risk management, third-party risk management, and GRC processes.
\n
• Experience developing business requirements, use cases, user stories, workflow diagrams, and testing documentation.
\n
• Proven experience managing enhancement requests and driving projects through the full solution lifecycle, from requirements gathering through testing and implementation.
\n
• Experience leading or coordinating User Acceptance Testing (UAT) and defect management processes.
\n
• Strong analytical, problem-solving, communication, and stakeholder management skills.
\n
• Ability to translate complex business requirements into functional solutions that align with organizational objectives.
\n
• Experience working in cross-functional environments involving business, cybersecurity, risk, compliance, and technology teams.
\n

Minimum Education/Experience

\n
• Bachelor’s degree in Information Security, Computer Science, Cyber, developer or related field; or equivalent experience.
\n
• 10 plus years of experience in cybersecurity risk analysis or related field.
\n
• Strong analytical skills, ability to work independently, and collaborative interpersonal skills.
\n
• Experience in business analysis, including requirements gathering and test case development.
\n

Certifications: Certified Scrum Master (CSM), ServiceNow Administrator, Developer, general user Certified

ServiceNow Knowledge

Preferred Experience

\n
• Experience with ServiceNow or similar vendor management software.
\n
• Understanding of procurement and risk processes.
\n
• Knowledge of information security and risk control frameworks.
\n
• Familiarity with ISO 27001, SOC 2, HITRUST, FedRAMP, and ISO 22301 standards.
\n
• Operational experience with GRC toolsets.
\n
• CISSP/CISM certification (or similar).
\n

Top 3 Preferred Skills:

\n
• ServiceNow CVRM, BCM, TPRM
\n
• ServiceNow Developer, implementer, general user Certified, PMP, CRISC, CISA, CISM
\n
• Audit experience
\n
• Microsoft Office
\n

Value to the Role (Nice-to-have vs Strong Advantage):

\n
• GRC experience, Vendor risk experience, or disaster recovery experience
\n
• Would help understand the risk as well as the possibilities the tool has to offer. Will also help them understand what they are testing
\n
• Will help understand the mindset for this role
\n

What projects will this person support: This person will support all requirements gathering, UAT testing, enhancement/ defects gathering, following release cycle working with cross functional teams, developers, data migration projects & presenting weekly statuses to leadership for Cybersecurity Vendor Risk Management Team (CVRM) and Business Continuity Management team (BCM) reporting to me, using ServiceNow platform

What does a typical day look like: Checking updates on incidents, defects or testings in progress, daily or weekly standup calls with stakeholders. Informing team on status updates for changes in the wind, testing of incidents and defects to identify correct path forward, working with developers and GRC teams to ensure proper prioritizing of upcoming work. Setting up meeting with CVRM and BCM teams to understand issue or incident raised, understand ServiceNow original stories and how to troubleshoot to find root cause

Who will they interact with regularly: Many cross functional teams from Governance Risk & Compliance (GRC), CVRM, BCM and the infrastructure teams IS, developers and ServiceNow platform owners & process owners to support ServiceNow changes

What does success look like in the first 90 days: Understanding ServiceNow inner workings, managing all issues, enhancements, defects and following release cycle closely. Presenting to leadership any obstacles, and in team meetings weekly updates on upcoming enhancements, testing cycles, or stories in progress

What personality traits work best with your team: Friendly, eager to learn, curious problem solver

What the candidate must be able to do:

\n
• Understand the release cycle for change management, follow the Platform’s schedule for upcoming releases
\n
• Understand what the tool’s capabilities can do, to guide teams if incidents are a true incident or even a possibility
\n