Job Title: Cybersecurity Risk Analyst (Third-Party & Internal Risk)
Location: Northbrook, IL (hybrid, onsite 3 days per week)
Position: Contract-to-Hire W2
⭐️ Grow Your Career with a Global Industry Leader
TalentFish is casting a line for a Cybersecurity Risk Analyst (TPRM & Internal Risk). This is a hybrid contract-to-hire opportunity located in Northbrook, IL.
Overview
· The Cybersecurity Risk Analyst will support cybersecurity risk assessments across technologies, business initiatives, and third-party providers.
· This position will manage approximately 50% vendor / third-party risk (TPRM) and 50% internal risk assessments, with an initial focus on coordinating vendor assessments with existing contractors.
· The ideal candidate will have experience independently managing risk assessments end-to-end, from intake through recommendations and remediation support, clearly communicating business risks, and managing competing priorities with minimal supervision.
What You Bring to the Role. (Required Experience)
- Bachelor's or master's degree in Business, Computer Science, Cybersecurity, Information Security, or related field.
- 4+ years of relevant cybersecurity, information security, technology risk, or risk management experience.
- Minimum 2+ years managing risk and compliance matters or supporting technologies, services, projects, systems, or third-party relationships involving risk identification, assessment, remediation, and monitoring. This experience may overlap with the requirement above.
- Proven ability to independently conduct cybersecurity risk assessments with minimal supervision, including identifying risks, evaluating controls, documenting conclusions, and recommending risk treatment.
- Hands-on understanding of third-party risk and internal risk assessment processes, with the ability to manage the assessment lifecycle from intake through remediation follow-up.
- Experience applying FAIR and NIST risk assessment methodologies, including quantitative and qualitative approaches; familiarity with ISO/IEC 27001.
- Hands-on ServiceNow experience managing vendor risk assessments and risk workflows is strongly preferred.
- Ability to evaluate control design and implementation and assess inherent and residual risk.
- Ability to translate technical security concerns into clear business risk statements and communicate findings to business and risk owners.
- Experience documenting risks and findings, maintaining risk registers, and tracking remediation with stakeholders.
- Strong analytical judgment, organization, and follow-through, with the ability to manage high assessment volume and competing priorities in a fast-moving environment.
- Familiarity with additional frameworks ISO/IEC 27001, COBIT, NIST Cybersecurity Framework, NIST SP 800-series, and FAIR
- CISSP, CISM, or CISA certifications are a plus, but is not required.
What You'll Do. (Skills Used in This Position)
- Independently conduct and manage cybersecurity and information risk assessments for technologies, services, business initiatives, and third-party providers.
- Divide responsibilities approximately equally between vendor/third-party risk and internal assessments.
- Initially prioritize vendor assessments, coordinating existing contractors and managing the assessment process from the internal business perspective.
- Own assessments from intake through analysis, recommendations, stakeholder communication, and remediation support.
- Identify and document risk scenarios, including assets, threats, vulnerabilities, controls, likelihood, and business impact.
- Develop clear risk statements and distinguish risks from issues/findings and control deficiencies within the risk register.
- Evaluate controls, recommend risk treatment, and assess residual risk after mitigating or compensating controls are implemented.
- Track risks, findings, and remediation activities through closure, maintaining consistent follow-up with stakeholders.
- Support exception management requests and related stakeholder coordination.
- Support third-party due diligence, control validation, ongoing monitoring, and remediation tracking.
- Communicate assessment results promptly and provide reporting that highlights material risks and outstanding remediation.
- Support responses to external customer security questionnaires and apply relevant legal, regulatory, contractual, and industry requirements when evaluating risks.
Compensation and Employment
This role requires authorization to work in the U.S. without current or future visa sponsorship. This position is available on a direct W2 basis only. The expected hourly rate for this position is $45 - $56 per hour W2, depending on experience and qualifications. This role qualifies for comprehensive benefits such as paid time off (PTO), optional medical, dental, and vision insurance, and 401(k) eligibility after 6-months. TalentFish is committed to pay transparency and equal opportunity. The compensation provided is in compliance with applicable state and federal regulations. All offers are contingent upon the completion of a background check, which may include but is not limited to reference checks, education verification, employment verification, drug testing, criminal records checks, and any required certifications or compliance requirements based on the end client's background check policies and applicable laws.
TalentFish is an employee-owned company pioneering a new realm in talent acquisition. We are redefining IT staffing by evolving AI, video screening, and our unique platform. TalentFish focuses on providing the best employee, consultant, and client experience possible. TalentFish is an Equal Opportunity Employer; we embrace and encourage diversity.
