Cybersecurity Risk Analyst

Quick Facts

• Role: Cybersecurity Risk Analyst (GRC)

• Focus: Application and third-party risk assessments, compliance evidence, and risk mitigation planning

Description

The Cybersecurity Risk Analyst performs technical risk assessments for applications and external vendors to identify cyber threats as well as operational and regulatory risks. You will work with Agile product teams and the GRC function to implement technical remediation aligned with policies and regulatory standards, and to produce detailed risk assessment reports for business unit owners. The role supports automated risk analytics and maintains compliance documentation against SOC 2, ISO 27001, PCI DSS, and NIST CSF 2.0.

Responsibilities

• Conduct technical assessments of application and third-party risks to identify cyber threats and operational/regulatory risks

• Collaborate with Agile product teams and the GRC function to implement technical remediation aligned with policies and regulatory requirements

• Create detailed assessment reports highlighting key risks and policy exceptions using risk/threat modeling

• Support development and execution of risk-exception plans and strategies with GRC and business units

• Assist in building automated quantitative and qualitative risk analysis and reporting processes

• Coordinate with internal and external auditors to provide documentation and evidence for international security standards (SOC 2, ISO 27001, PCI DSS, NIST CSF 2.0)

• Support product security changes and updates to security policies, security standards, and technical security requirements as needed

• Support execution of the broader GRC security program aligned with strategy and key metrics

Requirements

• Self-motivated and able to adapt in a constantly changing cybersecurity environment

• Strong collaboration skills and willingness to work as part of a cohesive, distributed team

• Excellent analytical and critical-thinking skills

• Comprehensive communication skills (effective listening, data gathering, and clear articulation of ideas)

• 5+ years of experience in information security with relevant education

• IT audit, internal audit, and/or cyber consulting experience is welcome

• Knowledge of cybersecurity frameworks/standards including NIST CSF, NIST 800-53, ISO 27001, and PCI DSS

• Preferred certifications: CISSP, CCSP, CISM, CISA, CompTIA Security+, GIAC

Benefits

• Comprehensive compensation and benefits package designed to be competitive, support employee well-being, and recognize individual impact

• Performance-based pay, with potential eligibility for annual bonuses and incentive benefits depending on role and location

• Health and wellness benefits, paid time off, retirement plans, insurance coverage, and other local/statutory benefits

• Compensation and benefits details will be discussed during the hiring process