Cyber Risk Management Analyst

Cyber Risk Management Analyst

Key Responsibilities

• Identify and assess cybersecurity risks across applications, infrastructure, third parties, and business processes.

• Conduct cyber risk assessments, control assessments, and risk reviews.

• Maintain and monitor the organization's cybersecurity risk register.

• Evaluate security controls against frameworks such as NIST CSF, NIST 800-53, ISO 27001, CIS Controls, and SOC 2 .

• Identify control gaps, document findings, and work with control owners to develop remediation plans.

• Track cybersecurity issues, vulnerabilities, exceptions, and remediation activities through closure.

• Support third-party/vendor cybersecurity risk assessments.

• Review security questionnaires, audit reports, penetration-testing results, and other security documentation.

• Assist with cybersecurity governance, risk, and compliance (GRC) activities.

• Prepare risk reports, dashboards, metrics, and management presentations.

• Support internal and external audits and regulatory examinations.

• Monitor changes in the threat landscape and assess their potential business impact.

• Assist with risk acceptance, exception management, and compensating-control reviews.

• Help develop and maintain cybersecurity policies, standards, procedures, and control documentation.

• Collaborate with Security, IT, Legal, Compliance, Internal Audit, Privacy, and business teams.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or a related field.

• 5+ years of experience in cybersecurity, IT risk, GRC, IT audit, compliance, or a related discipline.

• Knowledge of cybersecurity risk-management principles and security controls.

• Experience with risk assessments, control testing, issue management, and remediation tracking.

• Familiarity with security frameworks such as NIST, ISO 27001, CIS Controls, SOC 2, or COBIT .

• Strong analytical, documentation, communication, and problem-solving skills.

• Ability to translate technical cybersecurity risks into business-impact language.

Preferred Qualifications

• Experience with GRC platforms such as ServiceNow GRC, Archer, RSA, MetricStream, or OneTrust .

• Relevant certifications such as CRISC, CISA, CISSP, CISM, Security+, or ISO 27001 .

• Experience with third-party/vendor risk management.

• Knowledge of cloud security risks involving AWS, Azure, or GCP .

• Familiarity with vulnerability management, penetration testing, identity and access management, incident response, and security architecture.

• Understanding of privacy and regulatory requirements relevant to the organization's industry.