Cyber Security Risk Analyst

The Global Cybersecurity Risk Analyst will support the identification, assessment, communication, and management of cybersecurity and information risks across the organization. This role will help ensure that operational activities, technologies, and third-party relationships are appropriately evaluated and managed to reduce risk exposure and potential business impact. The Analyst will assess risks associated with business operations and third-party providers, including cybersecurity practices and applicable legal, regulatory, contractual, and industry requirements. The role will also support the documentation, tracking, and reporting of identified risks and issues and help ensure that appropriate mitigation actions are implemented to reduce residual risk to acceptable levels. Bachelor’s or master’s degree in business, Computer Science, Cybersecurity, Information Security, or a related field. 2+ years of experience in cybersecurity, information security, technology risk, or a related risk management role. 2+ years of experience managing risk and compliance matters or supporting applications, coordinating managed service provider activities, projects, systems, or third-party relationships requiring risk identification, assessment, remediation, and monitoring. Demonstrated understanding of operational, cybersecurity, information security, and technology risks. Strong business acumen with the ability to assess cybersecurity risks and potential impacts in the context of operational, financial, regulatory, and business objectives. Experience evaluating complex third-party risks through vendor risk management, information security, regulatory compliance, or audit activities. Hands-on experience using ServiceNow to perform and manage Vendor Risk Assessments. Experience working with recognized cybersecurity, risk, and compliance frameworks and methodologies, such as ISO/IEC 27001, COBIT, NIST Cybersecurity Framework, NIST SP 800-series guidance, and FAIR. What We Offer : Total Rewards: We understand compensation is an important factor as you consider the next step in your career. The estimated salary range for this position is $86,400-$115,100 USD and is based on multiple factors, including job-related knowledge/skills, experience, geographical location, as well as other factors. This position is eligible for annual bonus compensation with a target payout of 10% of the base salary. This position also provides health benefits such as medical, dental and vision; wellness benefits such as mental and financial health; and retirement savings (401K) commensurate with the standard rewards offered in each individual location or country. We also provide full-time employees with paid time off including vacation (15 days), holiday and personal days (totaling 12 days) and sick time off (72 hours). #LI-MK2 #LI-Hybrid Support focused cybersecurity and information risk assessments for new and existing technologies, services, business initiatives, and third-party providers. Identify and document risk scenarios, including relevant assets, threats, vulnerabilities, controls, likelihood, and potential business impact. Communicate risk assessment findings clearly and effectively to risk owners, business stakeholders, information governance teams, and cybersecurity teams. Provide risk-based guidance that enables stakeholders to make informed decisions regarding risk acceptance, mitigation, transfer, or avoidance. Identify and recommend appropriate controls and risk treatment activities to effectively manage cybersecurity and information risks. Identify opportunities to improve the organization’s risk posture and assist in developing remediation and mitigation strategies. Assess residual risk following the implementation of mitigating or compensating controls. Track identified risks, issues, remediation activities, and risk events through closure. Support the execution of the third-party/vendor risk management lifecycle, including risk assessments, due diligence, control validation, ongoing monitoring, and remediation tracking. Support responses to external customer cybersecurity and information security questionnaires. Apply applicable legal, regulatory, contractual, and industry requirements when evaluating cybersecurity and third-party risks. Support risk reporting and documentation to provide appropriate visibility into material risks, issues, and remediation activities.