Cybersecurity Governance & Risk Analyst or Sr. Cybersecurity Governance & Risk Analyst

Important Application Submission InformationIn order to ensure your application is successfully received before the job posting expires, please submit your application by 11:59 PM on Friday, September 18, 2026More than a career - a chance to make a difference in people's lives.Build an exciting, rewarding career with us – help us make a difference for millions of people every day. Consider joining the Duke Energy team, where you'll find a friendly work environment, opportunities for growth and development, recognition for your work, and competitive pay and benefits.The Cybersecurity Governance & Risk Analyst is the second level of the classification hierarchy. Employees at this level solve problems, in single areas of specialization, with general supervision. Incumbents are expected to develop skills, and the ability to work with greater independence. They have knowledge of fundamental concepts and procedures. The Sr. Cybersecurity Governance & Risk Analyst will be expected to manage work in multiple governance and risk areas with minimal supervision. The individual will be expected to have the ability to plan, design, and implement a cybersecurity risk and governance program and to work independently, with limited guidance. The individual is expected to be fully competent in the use of cyber risk and governance concepts and procedures, and demonstrate critical thinking skills to identify problems, develop solutions, and take actions to resolve or improve. The individual must have the capability to lead efforts with other team members. The individual will have working knowledge of governance and cybersecurity risk.Responsibilities Demonstrates working knowledge of IT and Cybersecurity policy, standards, processes, controls and functional areasCompetent in the use of IT and Cybersecurity tools, procedures, and research capabilitiesMonitor and evaluate the effectiveness of the enterprise's cybersecurity safeguards to ensure they provide the intended level of protection.Perform or assist in security reviews and identify security gaps in security architecture resulting in recommendations for inclusion in risk mitigation strategy. Perform or assist in cyber defense trend analysis and reportingCorrelate incident data to identify specific vulnerabilities and make recommendations that enable expeditious remediationAssess or assist in the assessment in the effectiveness of security controlsCollaborate with Cybersecurity leadership and architects to make sure security technologies, processes, and people align with Duke’s strategic plan and budget.Continually monitor and support security solutions including architecture and technologies and improve the architecture to meet performance and risk management objectivesCarries out individual work assignments of a less complex nature to meet established work schedules.Receives work assignments and works with review and direction by management or senior analyst.Performs or assists in the performance of technical project work as needed to complete project deliverables.Basic knowledge of IT and Cybersecurity policy, standards, processes, resources and controls.Able to apply process and controls knowledge to meet compliance requirements.Provides good customer support to deliver compliance results to internal and external partiesCommunicates with customers to understand compliance requirementsCommunicates problems and resolutions to manager and/or customersBasic/Required Qualifications for Cybersecurity Governance & Risk Analyst:Bachelors degree in Cybersecurity or related degreeIn addition to bachelor's degree, 2 years related experienceIn lieu of bachelor's degree AND 2 years minimum of related work experience listed above, high school diploma/GED AND 6 years minimum of related work experienceBasic/Required Qualifications for Sr. Cybersecurity Governance & Risk Analyst:Bachelor’s degree in Cybersecurity or related degreeMinimum 5 years Required of Related Work Experience.In lieu of degree(s) listed above, High School/GED AND 9 years related work experienceDesired QualificationsExperience in Cybersecurity, preferably with risk identification and management, audit and compliance, policy development and maintenance, evaluation of control requirements, security and related industry regulatory issuesKnowledge in validating the organization against policies/guidelines/procedures/regulations/laws to ensure complianceKnowledge in reviewing service performance reports identifying any significant issues and variances, initiating, where necessary, corrective actions and ensuring that all outstanding issues are followed upAbility to evaluate, analyze, and synthesize large quantities of data (which may be fragmented and contradictory) into high quality, fused targeting/intelligence products.Working knowledge of Cybersecurity frameworks such as NISTKnowledge of risk management processes (e.g., methods for assessing and mitigating risk).Able to work effectively with defined directionDemonstrated ability to work independently with supervisory review and directionExcellent listening and communication skills; able to present information in an understandable manner both verbal and written Demonstrated ability to absorb change and continue with positive resultsSkill in conducting audits or reviews of technical systems.Skill in performing impact/risk assessments.Skill in processing collected data for follow-on analysis.Recognize a possible security violation and take appropriate action to report the incident as requiredSupport necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs)Provide ongoing optimization and problem-solving supportDemonstrates good listening skills and puts forth the effort to understand others points of view. Has the ability to manage confidential information with a high degree of integrity. Responds well to supervisors, is easy to challenge and develop, and is easily coachable. Able to work effectively with defined directionPerform cyber defense trend analysis and reporting.Skill in creating and utilizing mathematical or statistical models.Research current technology to understand capabilities of required system or network.Knowledge of information technology (IT) supply chain security and supply chain risk management policies, requirements, and procedures.ServiceNow or similar asset management database experienceExperience creating dashboards in ServiceNow for compliance and cybersecurity monitoring/reportingKnowledge of traditional gas-industry OT devices such as PLCs, RTUs, VFDs, electronic correctors, etc.Direct experience with incident investigation and remediationDemonstrated ability to develop complex processes with multiple stakeholders for isolating/securing OT environments as part of incident response activitiesExperience tracking and remediating cybersecurity vulnerabilities in operational environmentsWorking ConditionsHybrid mobility classification – Work will be performed from both remote and onsite locations after the onboarding period. However, hybrid employees must live within a reasonable commute to their designated Duke Energy facility, not greater than 50 miles one way. Employees are expected to report to their assigned Duke Energy facility as required and directed by their manager, on average 3 full workdays per regular work week.Travel Requirements5-15%Relocation Assistance Provided (as applicable)NoRepresented/Union PositionNoVisa Sponsored PositionNo. This is not a Visa Sponsored Position. This role requires the ability to work lawfully in the U.S. without employment-based immigration sponsorship, now or in the future.Please note that in order to be considered for this position, you must possess all of the basic/required qualifications.PrivacyDo Not Sell My Personal Information (CA)Terms of UseAccessibilitySummaryLocation: Charlotte, NCType: Full time