Senior Cyber Risk Analyst (Contract to Hire)

Job Description

Job Description:\n\nJob Title: Cyber Risk Analyst - Senior (Contract to Hire)Location: Columbus, OH or Merrillville, INWork Model: Hybrid — onsite 3 days per week; candidates must be local to the Columbus, OH or Merrillville, IN areaRate: $46 - $52/hourContract Duration: November 16, 2026 – November 15, 2027Contract-to-Hire: YesEmployment Type: W-2 OnlyWork Authorization: U.S. Citizens Only; no visa sponsorship availablePosition Overview\nWe are seeking an experienced Senior Cyber Risk Analyst to support a mature and evolving Third Party Risk Management (TPRM) and Cyber Assessments program within a large utility environment.\nThis role will focus on assessing and managing cybersecurity risks associated with third-party suppliers and vendors, supporting vendor control assessments, maintaining third-party risk profiles, tracking issues and exceptions, and helping business and technology stakeholders make informed risk-management decisions.\nThe Senior Cyber Risk Analyst will work across Cybersecurity, Supply Chain, IT, Operational Technology, Compliance, Internal Audit, Innovation, and business teams to support third-party risk assessments throughout the vendor lifecycle, including onboarding, contract renewal, continuous monitoring, and issue remediation.\nA significant component of this role involves supporting and advancing the organization's enterprise Governance, Risk, and Compliance platform, including Archer GRC, as well as supporting control-assessment capabilities such as Fortress.\nThe ideal candidate brings substantial hands-on experience with TPRM, vendor cyber assessments, SOC 2 reviews, risk reporting, GRC platforms, NIST frameworks, and cross-functional stakeholder management.Key ResponsibilitiesThird Party Risk Management\n\n \n Support execution and continuous improvement of the enterprise Third Party Risk Management program.\n \n Perform and support cybersecurity assessments of suppliers, vendors, service providers, and other third parties.\n \n Assess third-party inherent risk and evaluate applicable cybersecurity controls.\n \n Develop and maintain third-party cyber risk profiles.\n \n Identify, document, and track vendor cybersecurity risks, deficiencies, exceptions, and remediation activities.\n \n Work with business owners and vendor relationship managers to ensure identified risks are understood and appropriately addressed.\n \n Support third-party risk activities associated with:\n \n \n Vendor onboarding\n \n Contract renewals\n \n Continuous monitoring\n \n Vendor control assessments\n \n Risk acceptance\n \n Exception management\n \n \n Analyze vendor risk posture and provide actionable information to support management decisions.\n \n Help ensure contracted services meet organizational security and risk-management expectations.\nCyber Assessments\n\n \n Execute or support Cyber Assessments across business, Cybersecurity, IT, Operational Technology, and Innovation organizations.\n \n Apply established assessment methodologies to determine when assessments are required and how they should be conducted.\n \n Ensure cybersecurity risks identified through assessments are appropriately documented, communicated, mitigated, or formally accepted.\n \n Coordinate assessment activities with internal stakeholders and external service providers.\n \n Ensure assessments meet established objectives, timelines, reporting requirements, and quality expectations.\n \n Support the development and implementation of Cyber Assessment program roadmaps.\n \n Help improve consistency and maturity across Cyber Assessment processes.\nVendor Control Assessments\n\n \n Perform or support supplier and vendor control assessments.\n \n Review vendor cybersecurity documentation and supporting evidence.\n \n Analyze SOC 2 reports and other security documentation to identify control deficiencies, exceptions, and risk considerations.\n \n Evaluate vendor controls against organizational cybersecurity requirements.\n \n Communicate assessment findings to vendor owners, Supply Chain, Cybersecurity teams, and management.\n \n Track findings through remediation or formal risk disposition.\n \n Support continuous monitoring of third-party cybersecurity posture.\nGRC & Archer Support\n\n \n Support and advance the use of Archer GRC as the system of record for cyber risk, compliance, policy, and assessment activities.\n \n Maintain third-party risk and assessment information within the GRC platform.\n \n Support workflows, reporting, data quality, and process adoption within Archer.\n \n Promote broader utilization and adoption of Archer across relevant business functions.\n \n Serve as an advocate for effective use of Archer capabilities.\n \n Assist with implementation of the Archer roadmap and enhancement initiatives.\n \n Help integrate GRC processes with enterprise systems and data sources.\n \n Support connections and process alignment involving systems such as:\n \n \n ServiceNow\n \n Workday\n \n Supply Chain systems\n \n Cybersecurity platforms\n \n \n Identify opportunities to improve automation, reporting, workflow efficiency, and data consistency within the GRC environment.\nFortress Control Assessments\n\n \n Support the organization's use of Fortress for third-party and control-assessment activities.\n \n Develop working knowledge of Fortress capabilities and assessment processes.\n \n Support control-assessment execution and reporting.\n \n Contribute to recommendations regarding ongoing use and enhancement of the platform.\n \n Help maximize the business and cybersecurity value obtained from Fortress assessments.\n \n Coordinate assessment results with broader third-party risk-management activities.\nRisk Reporting & Analytics\n\n \n Develop and maintain reports, dashboards, metrics, and analytical summaries related to third-party cybersecurity risk.\n \n Track:\n \n \n Vendor risk profiles\n \n Open findings\n \n Risk exceptions\n \n Remediation status\n \n Assessment completion\n \n Continuous-monitoring results\n \n \n Analyze assessment and vendor-risk information to identify trends and emerging risks.\n \n Provide clear information that enables management to make informed vendor-risk decisions.\n \n Translate detailed cybersecurity findings into concise business-focused reporting.\n \n Support leadership reporting and program performance metrics.\nSupply Chain & Vendor Lifecycle Integration\n\n \n Partner closely with Supply Chain teams to embed cybersecurity risk management into vendor processes.\n \n Support cyber-risk assessments during vendor onboarding and contract renewal.\n \n Help ensure vendor cybersecurity considerations are incorporated into supplier-management decisions.\n \n Coordinate with vendor relationship owners regarding identified cybersecurity risks.\n \n Partner with Cyber Vulnerability Management to support comprehensive third-party risk profiles.\n \n Provide cybersecurity risk information to support procurement and contract-management decisions.\nCompliance & Audit Support\n\n \n Collaborate with Cyber Compliance, NERC CIP Compliance, Pipeline Compliance, Internal Audit, and other governance functions.\n \n Support audit and issue-tracking activities related to Cyber Assessments and TPRM.\n \n Assist with remediation tracking and resolution of assessment or audit findings.\n \n Maintain documentation required to demonstrate effective third-party risk-management processes.\n \n Support compliance evidence and reporting requirements.\n \n Help ensure Cyber Assessment processes align with applicable organizational standards and regulatory requirements.\nCross-Functional Collaboration\n\n \n Work closely with:\n \n \n Enterprise Security\n \n IT\n \n Operational Technology\n \n Supply Chain\n \n Internal Audit\n \n Cyber Compliance\n \n NERC CIP Compliance\n \n Pipeline Compliance\n \n Innovation teams\n \n Business stakeholders\n \n Vendor relationship owners\n \n External service providers\n \n \n Educate stakeholders regarding third-party cybersecurity risk and assessment processes.\n \n Clearly communicate risk findings to both technical and non-technical audiences.\n \n Build productive working relationships across multiple business and technology functions.\n \n Support positive business perception of Cyber Assessment services through proactive engagement and responsive support.\nDay-to-Day Responsibilities\n\n \n Perform third-party cyber risk assessments.\n \n Review supplier and vendor security controls.\n \n Analyze SOC 2 reports and supporting cybersecurity documentation.\n \n Determine inherent risk levels for third parties.\n \n Maintain vendor risk profiles.\n \n Track cybersecurity findings, risks, exceptions, and remediation activities.\n \n Enter and maintain assessment data within Archer GRC.\n \n Support Fortress control assessments.\n \n Produce Cyber Assessment reports and dashboards.\n \n Coordinate with business owners and vendor relationship managers.\n \n Support Supply Chain vendor onboarding and contract-renewal processes.\n \n Participate in meetings with Cybersecurity, IT, OT, Supply Chain, and Compliance teams.\n \n Monitor outstanding assessment actions and follow up with stakeholders.\n \n Analyze third-party risk data and identify trends.\n \n Support process-improvement initiatives across the Cyber Assessments program.\n \n Assist with audit and compliance requests.\n \n Help advance adoption and effectiveness of GRC tools and processes.\nRequired Qualifications\n\n \n Bachelor's degree or equivalent combination of education and relevant professional experience.\n \n 6+ years of Third Party Risk Management experience across relevant support functions.\n \n 6+ years of experience with vendor control assessments, SOC 2 reports, risk reporting, and metrics.\n \n Strong working knowledge of TPRM processes, methodologies, reporting, and metrics.\n \n Experience assessing vendor cybersecurity posture and identifying third-party risks.\n \n Experience managing cybersecurity findings, risk exceptions, and remediation activities.\n \n Solid understanding of cybersecurity risk-management principles and industry best practices.\n \n Strong understanding of the NIST Cybersecurity Framework and related cybersecurity-control concepts.\n \n Experience working with GRC processes and risk-management platforms.\n \n Strong analytical and problem-solving capabilities.\n \n Experience with process analysis, process development, and root-cause analysis.\n \n Strong Microsoft Office 365 skills.\n \n Ability to quickly learn new technologies, systems, and cybersecurity concepts.\n \n Strong collaboration, negotiation, communication, organizational, and conflict-resolution skills.\n \n Demonstrated experience contributing to process-improvement initiatives.\n \n Strong written and verbal communication skills.\n \n Demonstrated experience successfully supporting or delivering TPRM projects.\n \n Ability to work independently across multiple functional domains with limited assistance.\n \n Ability to communicate effectively with technical and non-technical stakeholders.\n \n Must be a U.S. Citizen.\n \n Must be local to the Columbus, OH or Merrillville, IN area and able to work onsite three days per week.\nPreferred Qualifications\n\n \n Experience using Archer GRC / RSA Archer.\n \n Experience with Fortress or similar third-party cybersecurity assessment platforms.\n \n Experience with Microsoft Excel and Word.\n \n Experience with SharePoint.\n \n Experience developing reports, dashboards, and analytics.\n \n Experience with ServiceNow.\n \n Experience supporting integrations between GRC platforms and enterprise systems.\n \n Knowledge of electric and gas utility operations.\n \n Previous experience within the utility, energy, or critical-infrastructure sector.\n \n Familiarity with NERC CIP, Pipeline Compliance, or other regulated cybersecurity environments.\n \n Experience supporting Supply Chain, procurement, or vendor-management processes.\n \n Experience with continuous third-party risk monitoring.\nCore Competencies\n\n \n Third Party Risk Management\n \n TPRM\n \n Cyber Risk\n \n Cyber Assessments\n \n Vendor Risk Management\n \n Vendor Control Assessments\n \n SOC 2\n \n Archer GRC\n \n RSA Archer\n \n Fortress\n \n Governance, Risk & Compliance\n \n NIST Cybersecurity Framework\n \n Risk Assessments\n \n Risk Profiles\n \n Risk Exceptions\n \n Remediation Tracking\n \n Continuous Monitoring\n \n Cybersecurity Compliance\n \n Supply Chain Risk\n \n Vendor Management\n \n Reporting & Analytics\n \n Cybersecurity Metrics\n \n Process Improvement\n \n Stakeholder Management\n \n Audit Support\n \n ServiceNow\nIdeal Candidate Profile\nThe ideal candidate is an experienced Third Party Risk Management professional who can independently evaluate supplier and vendor cybersecurity risks while working effectively across Cybersecurity, IT, OT, Supply Chain, Compliance, Audit, and business organizations.\nThe strongest candidate will have substantial hands-on experience conducting vendor control assessments, reviewing SOC 2 reports, maintaining third-party risk profiles, managing findings and exceptions, and producing meaningful risk reporting and metrics.\nThey should also be comfortable operating within an enterprise GRC environment, ideally Archer, and understand how third-party cybersecurity risk fits into vendor onboarding, contract renewal, continuous monitoring, and broader supply chain risk-management processes.\nSuccess in this role requires someone who can combine technical cybersecurity knowledge with strong business communication, analytical judgment, and the ability to turn complex assessment results into clear and actionable risk information.