Senior Information Security Risk Analyst

Salary: $106,000 - 152,000 per year Requirements:

• We require 5+ years of experience in cybersecurity, information security, or cyber risk, ideally with exposure to third-party risk management, IT risk, audit, incident response, or access management.
• We need experience evaluating vendor security posture in cloud-based and enterprise environments.
• We expect strong knowledge of systems, networks, application architecture, cloud security, and secure design across AWS, Azure, SaaS, PaaS, APIs, and enterprise integrations.
• We look for experience assessing data flows, data classification, data protection, data governance, and secure data handling practices.
• We require familiarity with IAM, SSO, federation, privileged access, cyber threats, vulnerabilities, and attack techniques.
• We need the ability to interpret SOC 1, SOC 2, ISO certifications, and other third-party assurance materials to identify control gaps and residual risk.
• We expect strong analytical judgment, attention to detail, and risk-based decision-making.
• We need the ability to identify, assess, and clearly communicate complex cyber risks, trade-offs, and residual exposure.
• We require the ability to recommend practical, business-aligned mitigation strategies, including compensating controls and secure design changes.
• We need strong communication skills to translate technical findings into clear, business-relevant recommendations.
• We expect effective stakeholder management and partnership across business, technology, procurement, and legal teams.
• We value a collaborative, solutions-oriented mindset with strong influencing skills in a fast-paced assessment environment.
• We look for a high degree of professional skepticism and curiosity when evaluating vendor claims and evidence.
• We require the ability to manage multiple priorities independently while maintaining quality and consistency.
• We need proficiency with Microsoft Office tools.
• Relevant certifications such as CISSP, CISA, CSA, CISM, Security+, GIAC, CEH, or similar are strongly preferred.
• A bachelors degree in information security, Computer Science, Information Technology, or a related field is required; equivalent relevant work experience may also be considered.

• We lead end-to-end third-party solution risk assessments and vendor security reviews across the vendor lifecycle, including due diligence, onboarding, ongoing monitoring, and reassessments.
• We evaluate vendor security programs, control effectiveness, and governance, as well as the specific solution being implemented, including architecture, data flows, and integration points.
• We identify and communicate inherent and residual cyber risks related to data protection, privacy, IAM, privileged access, system connectivity, and external attack surface exposure.
• We review and interpret security documentation such as SOC 1/SOC 2 reports, ISO 27001 certifications, audit reports, architecture diagrams, data flow diagrams, and technical configurations.
• We recommend practical risk mitigation strategies, including compensating controls, secure design changes, and contractual safeguards to support risk-informed decisions.
• We partner with business, technology, procurement, and legal teams to support risk acceptance, exception management, and third-party risk governance.
• We contribute to the evolution of our third-party risk management framework, methodology, and standards in alignment with NIST, ISO 27001, NYDFS, and other applicable regulatory expectations.

• AWS
• Azure
• Cloud
• Flow
• IAM
• Support
• PaaS
• Security

More:

We are FM, a leading mutual insurance company established nearly two centuries ago. Our capital, scientific research capability, and engineering expertise are dedicated to property risk management and strengthening the resilience of our policyholder-owners, including many of the worlds largest organizations and one of every four Fortune 500 companies. In this Senior Information Security Analyst role, we focus on protecting our business by assessing the security risks of third-party vendors, SaaS platforms, and cloud solutions. This is an on-site role one day per week at our Corporate Headquarters, with flexibility to be on-site when business needs require it. Relocation is not offered. We offer a comprehensive Total Rewards program that includes an incentive plan, medical, dental and vision insurance, life and disability insurance, well-being programs, a 401(k) and pension plan, career development opportunities, tuition reimbursement, flexible work, and time off including vacation and sick leave. We are an equal opportunity employer committed to building and retaining a diverse workforce.

last updated 36 week of 2026