Cyber Risk Management Analyst

Key Responsibilities

• Identify and assess cybersecurity risks across applications, infrastructure, third parties, and business processes.
• Conduct cyber risk assessments, control assessments, and risk reviews.
• Maintain and monitor the organization's cybersecurity risk register.
• Evaluate security controls against frameworks such as NIST CSF, NIST 800-53, ISO 27001, CIS Controls, and SOC 2.
• Identify control gaps, document findings, and work with control owners to develop remediation plans.
• Track cybersecurity issues, vulnerabilities, exceptions, and remediation activities through closure.
• Support third-party/vendor cybersecurity risk assessments.
• Review security questionnaires, audit reports, penetration-testing results, and other security documentation.
• Assist with cybersecurity governance, risk, and compliance (GRC) activities.
• Prepare risk reports, dashboards, metrics, and management presentations.
• Support internal and external audits and regulatory examinations.
• Monitor changes in the threat landscape and assess their potential business impact.
• Assist with risk acceptance, exception management, and compensating-control reviews.
• Help develop and maintain cybersecurity policies, standards, procedures, and control documentation.
• Collaborate with Security, IT, Legal, Compliance, Internal Audit, Privacy, and business teams.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or a related field.
• 5+ years of experience in cybersecurity, IT risk, GRC, IT audit, compliance, or a related discipline.
• Knowledge of cybersecurity risk-management principles and security controls.
• Experience with risk assessments, control testing, issue management, and remediation tracking.
• Familiarity with security frameworks such as NIST, ISO 27001, CIS Controls, SOC 2, or COBIT.
• Strong analytical, documentation, communication, and problem-solving skills.
• Ability to translate technical cybersecurity risks into business-impact language.

Preferred Qualifications

• Experience with GRC platforms such as ServiceNow GRC, Archer, RSA, MetricStream, or OneTrust.
• Relevant certifications such as CRISC, CISA, CISSP, CISM, Security+, or ISO 27001.
• Experience with third-party/vendor risk management.
• Knowledge of cloud security risks involving AWS, Azure, or GCP.
• Familiarity with vulnerability management, penetration testing, identity and access management, incident response, and security architecture.
• Understanding of privacy and regulatory requirements relevant to the organization's industry.

Skills: risk management,management,cybersecurity,risk,security,it,documentation,cyber,iso,grc