Information Security Manager 3 - GRC Risk Register Analyst - TX REMOTE - local

Information Security Manager 3 GRC Risk Register Analyst

Position: Information Security Manager 3 Security
Location: Austin, Texas
Work Arrangement: Remote

Position Overview

seeking an experienced Information Security Manager 3 GRC Risk Register Analyst to design, establish, and operationalize an enterprise cybersecurity and technology risk register framework.

The ideal candidate will have strong experience in risk register design, risk scoring and prioritization, governance processes, stakeholder engagement, documentation, and knowledge transfer. The candidate will work closely with business, technology, security, and governance stakeholders to establish effective risk management workflows and ensure the organization's risk posture is documented and managed in an audit-ready manner.

Key Responsibilities

• Define end-to-end governance workflows for:
  • Risk identification and intake
  • Risk review and validation
  • Risk acceptance, mitigation, and transfer
  • Ongoing monitoring and periodic reassessment
• Establish clear roles and responsibilities for:
  • Risk owners
  • Risk reviewers
  • Governance bodies
• Design escalation and reporting processes for high-risk and accepted risks.
• Engage business, technology, security, and governance stakeholders to validate risk requirements and workflows.
• Facilitate working sessions and workshops to socialize the enterprise risk register and governance processes.
• Support the onboarding and initial population of risks into the enterprise risk register.
• Develop audit-ready documentation covering:
  • Risk register structure and data definitions
  • Risk scoring methodology
  • Governance workflows
  • Decision authorities
• Provide knowledge transfer and enablement to designated security staff to ensure long-term sustainability of the risk management program.

Required Qualifications

Candidates must have a minimum of 8 years of experience in each of the following areas:

• Risk Register Design and Framework
• Risk Scoring and Prioritization Models
• Governance Processes and Workflows
• Stakeholder Engagement and Enablement
• Documentation and Knowledge Transfer

Key Skills

• Enterprise Risk Management
• Cybersecurity Risk Management
• GRC
• Risk Register Development
• Risk Identification and Assessment
• Risk Scoring and Prioritization
• Risk Mitigation and Acceptance
• Governance Frameworks
• Risk Monitoring and Reporting
• Stakeholder Management
• Process Design
• Workshop Facilitation
• Audit-Ready Documentation
• Knowledge Transfer
• Security Governance

Expected Deliverables

1. Enterprise Risk Register Framework

• Standardized risk register template
• Risk taxonomy

2. Risk Scoring and Prioritization Model

• Likelihood and impact scales
• Scoring methodology
• Risk prioritization logic

3. Risk Governance Model

• Risk intake, review, acceptance, and monitoring workflows
• Roles and responsibilities matrix

4. Initial Risk Register Population

• Initial set of documented risks representing the current cybersecurity and technology risk posture

5. Final Documentation Package

• Consolidated guidance
• Operating procedures for ongoing risk managements